Found this: [URL]
I have a mixed volume on Isilon and I access it from SMB and NFS. Path: /ifs/mixed_mode, shared as SMB share and exported as NFS export as well. If I mount such a volume on a Linux machine and create a few files and view them on SMB, I see the user and group on SMB as "S-1-22-1-1000" and "S-1-22-2-1000" respectively. For the Linux user, UID and GID are both thousand. So, it seems like 'S-1-22-1' and'S-1-22-2' prefix is prepended, but why? Is there a way I can query this prefix or infer this indirectly?
Understanding SID generation for UNIX users