CODEWITHSUNDEEP
powershellwindows-7
johnny
johnny

Reputation: 19735

How do I get a local NT Service SID using Powershell?

I found this snippet on SO:

Get User SID From Logon ID (Windows XP and Up)

Function GetSIDfromAcctName()
{
$myacct = Get-WmiObject Win32_UserAccount -filter "Name = '$env:USERNAME " 
write-host Name: $myacct.name
Write-Host SID : $myacct.sid
}

But it doesn't show everything.

For example, I just want the sid of "nt service\dhcp." How can I get that? When I run my powershell manually with

Get-WmiObject Win32_UserAccont

I get all the users, but there's only three "regular" users. None of the "special" nt service users.

Thanks for help.

Upvotes: 4

Views: 11466

Answers (2)

JPBlanc
JPBlanc

Reputation: 72640

If you want to know the name of the account under which a service is started you can use:

Get-WMIObject -Class 'Win32_Service' -Filter "name='dhcp'" | % {return $_.startname}

The result is "NT Authority\LocalService", which is a well known SID. As discribed in SID Values For Default Windows NT Installations, you'll find more SIDs in Well-known security identifiers in Windows operating systems.

Edit

As you can see in the following screen shot, yes the DHCP client is running in a session started as "NT Authority\LocalService":

Screenshot

Upvotes: 1

Andy Arismendi
Andy Arismendi

Reputation: 52619

To get the built-in accounts, you need another WMI class: Win32_Account.

Get-WMIObject -Class 'Win32_Account' -Filter 'name="LOCAL SERVICE"'

Upvotes: 4

Related Questions