Unknown Windows SID Mapped to Proxy During SSIS Package Execution I'm running SSIS packages stored in a SQL Server 2014 catalog via scheduled SSA jobs. I'm reviewing my SQL Audit capture and noting calls to SSISDB are coming from the proxy I created when looking at the value for [session_server_principal_name], but the SID showing up in [server_principal_name] doesn't correspond to the Active Directory SID. My proxy has an AD SID prefixed with the typical 'S-1-5...' but the audit is returning a SID with a prefix of 'S-1-9...'. Is that indicative of a contained user for SSISDB dynamically created at job runtime to execute the SSIS task?
Check the blog post I wrote concerning how to identify this S-1-9 SID.

From that post:


  This can happen as a result of using EXECUTE AS USER = 'SomeUser'; to switch context to another user that doesn’t have a server-level account. 


I imagine you'd see this exact scenario for contained users.

There is also an MSDN post from 2006 showing this SID.