4.1.4.2.8 DomainSidFromSid

 procedure DomainSidFromSid(sid: SID): SID 

Removes the last subauthority from the input security identifier sid and returns the resulting security identifier, which is the domain SID. If the input is null, the procedure returns null. See [MS-DTYP] section 2.4.2 for more details on SIDs.