Why does wmic report another SID than whoami /user?

Question

When I execute whoami /user on the command line, I get

User Name             SID
===================== ==============================================
tq84\rene.nyffenegger S-1-5-21-1111111111-2222222222-3333333333-1224

However, If I execute wmic useraccount where name='%username%' get sid I get a different SID:

S-1-5-21-4444444444-5555555555-6666666666-1001

Not only is the RID different, but also the figures that are supposed to identify the domain.

Is this behaviour expected or is something gone wrong with the SID database on my system?

score 1 · Accepted Answer · answered Jan 26 '20 at 15:19

1

Try specifying the domain (or computername for local accounts)

wmic useraccount where "Domain='%userdomain%' AND name='%username%'"

answered Jan 26 '20 at 15:19

Greg Askew

34,339
3
52
81

This reports `No Instance(s) Available`, probably because I am disconnected from the domain controller. I need to check again tomorrow when my computer is connected again. – René Nyffenegger Jan 26 '20 at 15:21
Now that I am connected to the DC, I get the same SIDs with your query. – René Nyffenegger Jan 27 '20 at 14:09

Why does wmic report another SID than whoami /user?

1 Answers1