private static final String TEST_DOMAIN = "TESTDOMAIN";
    private static final String TEST_SERVER = "SERVER01";

    private SID domainSid;
    private SID userSid;

    @BeforeEach
    void setUp() throws Exception {
        domainSid = new SID("S-1-5-21-1-2-3");
        userSid = new SID("S-1-5-21-1-2-3-1000");
    }

    private void writeLittleEndianShort(DataOutputStream dos, short value) throws IOException {

 * "The .NET Developer's Guide to Windows Security" (which is also
 * available online).
 * <p>
 * Direct ACEs are evaluated first in order. The SID of the user performing
 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access

    }

    @Nested
    @DisplayName("SID Tests")
    class SidTests {

        @Test
        @DisplayName("Should encode SID correctly")
        void testSidTEncode() throws NdrException {
            // Given: A SID with test values
            rpc.sid_t sid = new rpc.sid_t();
            sid.revision = (byte) 1;
            sid.sub_authority_count = (byte) 2;

        super(config, SMB_COM_TRANSACTION2, SmbComTransaction.TRANS2_FIND_FIRST2);
    }

    /**
     * Gets the search ID for this response.
     *
     * @return the sid
     */
    public final int getSid() {
        return this.sid;
    }

    /**
     * Checks if this is the end of the search results.
     *
     * @return the isEndOfSearch
     */
    public final boolean isEndOfSearch() {

package jcifs.smb1.dcerpc.msrpc;

import jcifs.smb1.smb1.SID;

class LsarSidArrayX extends lsarpc.LsarSidArray {

    LsarSidArrayX(final SID[] sids) {
        this.num_sids = sids.length;
        this.sids = new lsarpc.LsarSidPtr[sids.length];
        for (int si = 0; si < sids.length; si++) {
            this.sids[si] = new lsarpc.LsarSidPtr();
            this.sids[si].sid = sids[si];
        }
    }

        // Owner SID offset
        if (includeOwner) {
            SMBUtil.writeInt4(currentOffset, buffer, offset + 4);
            prepareSimpleSid(buffer, offset + currentOffset);
            currentOffset += 20; // Simple SID size
        } else {
            SMBUtil.writeInt4(0, buffer, offset + 4);
        }

        // Group SID offset
        if (includeGroup) {

import jcifs.dcerpc.rpc.sid_t;
import jcifs.smb.SID;

class LsarSidArrayX extends lsarpc.LsarSidArray {

    LsarSidArrayX(final jcifs.SID[] sids) {
        this.num_sids = sids.length;
        this.sids = new lsarpc.LsarSidPtr[sids.length];
        for (int si = 0; si < sids.length; si++) {
            this.sids[si] = new lsarpc.LsarSidPtr();
            this.sids[si].sid = sids[si].unwrap(sid_t.class);
        }
    }

     * @return the access mask for this ACE
     */
    public int getAccessMask() {
        return access;
    }

    /**
     * Return the SID associated with this ACE.
     * @return the SID for this ACE
     */
    public SID getSID() {
        return sid;
    }

    int decode(final byte[] buf, int bi) {
        allow = buf[bi] == (byte) 0x00;
        bi++;
        flags = buf[bi++] & 0xFF;

            when(mockResource.getOwnerGroup(true)).thenReturn(mockSID);

            // When
            SID ownerUser1 = mockResource.getOwnerUser();
            SID ownerUser2 = mockResource.getOwnerUser(false);
            SID ownerGroup1 = mockResource.getOwnerGroup();
            SID ownerGroup2 = mockResource.getOwnerGroup(true);

            // Then

        bufferIndex += 2;
        final int ownerUOffset = ServerMessageBlock.readInt4(buffer, bufferIndex); // offset to owner sid
        bufferIndex += 4;
        final int ownerGOffset = ServerMessageBlock.readInt4(buffer, bufferIndex); // offset to group sid
        bufferIndex += 4;
        final int saclOffset = ServerMessageBlock.readInt4(buffer, bufferIndex); // offset to sacl
        bufferIndex += 4;