How to know SID of Windows' user account?

Question

When you look at HKEY_USERS registry key, each subkey (representing each user's settings) looks something like S-1-5-18 which is called SID I guess.

How do I know which SID is for which user account?

Answer 1

How to Associate a Username with a Security Identifier (SID)

Open Registry Editor and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \ProfileList

Under the ProfileList key, you will see the SIDs. By selecting each one individually, you can look at the value entry and see what user name is associated with that particular SID.

Answer 2

One can use PsGetSid also.

Answer 3

I use the following VB Script, rather than installing additional utilities. I can't take credit for the individual components of it, just the combination of them:

Lookup_SID.vbs

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

UserName = UserInput( "Enter the user name:", "" )
Domain = UserInput( "Enter the domain / PC name:", "")

Set objAccount = objWMIService.Get _
("Win32_UserAccount.Name='" & UserName & "',Domain='" & Domain & "'")
Call UserInput( "The SID for " & Domain & "\" & UserName & " is: ", objAccount.SID )

Function UserInput( myPrompt, default_text )
' This function prompts the user for some input.
' When the script runs in CSCRIPT.EXE, StdIn is used,
' otherwise the VBScript InputBox( ) function is used.
' myPrompt is the the text used to prompt the user for input.
' The function returns the input typed either on StdIn or in InputBox( ).
' Written by Rob van der Woude
' http://www.robvanderwoude.com
    ' Check if the script runs in CSCRIPT.EXE
    If UCase( Right( WScript.FullName, 12 ) ) = "\CSCRIPT.EXE" Then
        ' If so, use StdIn and StdOut
        WScript.StdOut.Write myPrompt & " "
        UserInput = WScript.StdIn.ReadLine
    Else
        ' If not, use InputBox( )
        UserInput = InputBox( myPrompt,, default_text )
    End If
End Function

Answer 4

Powershell I found elsewhere on the internet (don't have original source):

$objSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxx-xxxxxx") 
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount]) 
$objUser.Value

Also, this link may be of some value: Details on SIDs

Answer 5

Open a cmd window and type the following command

wmic useraccount where name='USERID' get sid

where USERID is the username whose SID you are looking for.

Answer 6

Look at the keys in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList