User name by SID?

Question

How can I determine user name and domain if all I have is the user's SID?

Answer 1

ADFind can do this. The list of options is here. For example, you might do something like this to export a list of users with their SID:

adfind -h domaincontroller01:389 -b "CN=Users,DC=domain,DC=com" -f "(objectClass=user)" objectSID displayName

You can run ADFind from any box as long as it can reach a domain controller. Obviously you would replace domaincontroller01 with the name or IP of a domain controller and change the "CN=Users,DC=domain,DC=com" to reflect the path to the users in question.

Answer 2

psgetsid from SysInternals PSTools will do this. Put a SID on the command line it will give you the user/group name, and visa-versa.

Answer 3

Fire up windows powershell and run:

$strSID="S-1-5-21-500000003-1000000000-1000000003-1001"
$uSid = [ADSI]"LDAP://<SID=$strSID>"
echo $uSid

the output should look something like this,

distinguishedName : {CN=John Doe,OU=Domain Admins,OU=People,OU=xxx,DC=xxx}
Path              : LDAP://<SID=S-1-5-21-500000003-1000000000-1000000003-1001>

Answer 4

1. Open regedit (Windows-R regedit)
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
3. Click on the subkeys (something like S-1-5-19)
4. Look at the ProfileImagePath (it'll have something like %SystemDrive%\Documents and Settings\LocalService).

So in this example SID S-1-5-19 is LocalService