Which registry key would you use to discover the SID associated with a particular user?
Is there a way to connect between the values under HKEY_USERS to the actual username? Show asked May 27, 2010 at 7:40
If you look at either of the following keys: You can find a list of the SIDs there with various values, including where their "home paths" which includes their usernames. I'm not sure how dependable this is and I wouldn't recommend messing about with this unless you're really sure what you're doing. answered May 27, 2010 at 7:57
Hans OlssonHans Olsson 53.4k14 gold badges91 silver badges113 bronze badges 2 It is possible to query this information from WMI. The following command will output a table with a row for every user along with the SID for each user.
You can also export this information to CSV:
I have used this on Vista and 7. For more information see WMIC - Take Command-line Control over WMI. answered Jun 8, 2011 at 20:10
dcharlesdcharles 4,7322 gold badges30 silver badges29 bronze badges 4
answered Apr 25, 2012 at 7:26
StoneStone 1711 silver badge2 bronze badges 1 By searching for my userid in the registry, I found
answered Sep 12, 2016 at 21:13
Alan FrankAlan Frank 891 silver badge2 bronze badges 2 You can use the command PSGetSid from Microsoft's SysInternals team. Download URL: http://technet.microsoft.com/en-gb/sysinternals/bb897417.aspx Usage:
Example:
NB:
Update If you use PowerShell, the following may be useful for resolving any AD users listed:
You could also refine the SID filter further to only pull back those SIDs which will resolve to an AD account if you wished; more on the SID structure here: https://technet.microsoft.com/en-us/library/cc962011.aspx answered Jun 13, 2014 at 13:51
JohnLBevanJohnLBevan 21.4k9 gold badges93 silver badges171 bronze badges In the
Kingsley 13.9k5 gold badges31 silver badges51 bronze badges answered Dec 2, 2018 at 22:29
1
alecxe 450k114 gold badges1045 silver badges1168 bronze badges answered May 21, 2013 at 19:16
DaLuaDaLua 111 bronze badge 1 Done it, by a bit of creative programming,
and you will find the same numbers.... Now in those keys look at the String value: ProfileImagePath = "SomeValue" where the values are either: "%systemroot%\system32\config\systemprofile"... not interested in this one... as its not a directory path... %SystemDrive%\Documents and Settings\LocalService - "Local Services" %SystemDrive%\Documents and Settings\NetworkService "NETWORK SERVICE" or %SystemDrive%\Documents and Settings\USER_NAME, which translates directly to the "USERNAME" values in most un-tampered systems, ie. where the user has not changed the their user name after a few weeks or altered the paths explicitly... answered Mar 7, 2012 at 15:41
1 The proper way to do this requires leveraging the SAM registry hive (on Windows 10, this requires Each subkey is the username, and the default value in each subkey is a binary integer. This value (converted to decimal) actually corresponds to the last chunk of the of the SID. Take "Administrator" for example, by default it is associated with the integer 0x1f4 (or 500). So, in theory you could take the build a list of SIDS based on the subkey names of the If you don't have reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab answered Oct 27, 2019 at 2:38
How do I find the SID of AD user?To get AD group SID in the active directory, use the Get-ADGroup cmdlet. The Get-ADGroup cmdlet gets a group account specified by the Identity parameter in the PowerShell script.
Which registry key holds user profiles?The registry contains a key called ProfileList located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion. This registry key contains one subkey for each user profile on a Windows machine.
How do I find the SID of a security group?SID (Security IDentifier) is a unique id number assigned to each user on windows computer, group or computer on domain-controlled network. You can get current user SID in Active Directory using PowerShell Get-LocalUser cmdlet or ad user SID using Get-ADUser cmdlet in PowerShell.
What identifier is used to search users?The SID (Security IDentifier) is a unique ID number that a computer or domain controller uses to identify you. It is a string of alphanumeric characters assigned to each user on a Windows computer, or to each user, group, and computer on a domain-controlled network such as Indiana University's Active Directory.
|