CODEWITHSUNDEEP
cmd
user4313427
user4313427

Reputation:

Getting the admin's SID

How do I get only the administrator account's sid using the wmic useraccount command in windows cmd ?

wmic useraccount get sid where admin=true

should be something like that I guess.

Upvotes: 1

Views: 1724

Answers (2)

Bill Dinger
Bill Dinger

Reputation: 179

Thanks to well known SIDs we know that an admin account is always going to start with S-1-5- and ends with -500 (http://blogs.technet.com/b/heyscriptingguy/archive/2005/07/22/how-can-i-determine-if-the-local-administrator-account-has-been-renamed-on-a-computer.aspx). This also ensures you are getting the admin account even if somebody renamed it from administrator

wmic useraccount where "SID like 'S-1-5-%-500'" get sid

Upvotes: 0

Andy
Andy

Reputation: 50600

You can get administrator's SID by doing this:

wmic useraccount where name='administrator' get sid

This returns a result similar to this:

SID
S-1-5-21-4067126559-1921051348-1512596144-500

Upvotes: 1

Related Questions