Find Security Identifier (SID) of User in Windows 11 Tutorial (2024)

This tutorial will show you how to find the security identifier (SID) of a specific user or all users on your Windows 10 and Windows 11 PC.

A security identifier (SID) is a string value of variable length that is used to uniquely identify a security principal or security group. Security principals can represent any entity that can be authenticated by the operating system, such as a user account, a computer account, or a thread or process that runs in the security context of a user or computer account.

Each account or group, or each process that runs in the security context of the account, has a unique SID that's issued by an authority, such as a Windows domain controller. The SID is stored in a security database. The system generates the SID that identifies a particular account or group at the time the account or group is created. When a SID has been used as the unique identifier for a user or group, it can never be used again to identify another user or group.

Each time a user signs in, the system creates an access token for that user. The access token contains the user's SID, user rights, and the SIDs for any groups the user belongs to. This token provides the security context for whatever actions the user performs on that computer.

Users refer to accounts by the account name, but the operating system internally refers to accounts and processes that run in the security context of the account by using their SIDs.

The operating system generates a SID that identifies a particular account or group at the time the account or group is created. The SID for a local account or group is generated by the Local Security Authority (LSA) on the computer, and it's stored with other account information in a secure area of the registry.

For every account and group, the SID is unique for the computer where it was created. No two accounts or groups on the computer ever share the same SID.

Reference:

EXAMPLE: Security Identifier (SID) with account association

1 Open Windows Terminal, and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

whoami /user​

1 Open Windows Terminal, and select Command Prompt.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

wmic useraccount where name='%username%' get domain,name,sid​

1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below you want to use into Windows Terminal, and press Enter. (see screenshots below)

(Outputs SID with username)​

[Security.Principal.WindowsIdentity]::GetCurrent() | Select-Object -Property @('Name', 'User')​

OR​

(Outputs only SID)​

[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value​

1 Open Windows Terminal, and select Command Prompt.

2 Type the command below into Windows Terminal, and press Enter. (see screenshot below)

wmic useraccount where name='username' get sid​

1 Open Windows Terminal, and select Command Prompt.

2 Type the command below into Windows Terminal, and press Enter. (see screenshot below)

wmic useraccount where sid='<sid>' get domain,name​

1 Open Windows Terminal, and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

wmic useraccount get domain,name,sid​

1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

Get-WmiObject win32_useraccount | Select domain,name,sid​

1 Open Windows Terminal, and select Windows PowerShell.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below)

Get-LocalUser | Select-Object -Property @('Name', 'SID')​

1 Open Registry Editor (regedit.exe).

2 Navigate to the key below in the left pane of Registry Editor. (see screenshot below)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList​

3 Each subkey under the ProfileList key in the left pane represents a SID. Look at the ProfileImagePath value in the right pane for each SID subkey to identify the full path of an account's profile folder name.

For example, the S-1-5-21-1858701626-1738369404-427713822-1001 subkey is the SID for the user with the C:\Users\Brink profile folder path and Brink being the account name.

That's it,
Shawn Brink