How to get all (non-disabled) user SIDs via Windows API?

Question

I'm looking for a way to retrieve all user SIDs on a system via the Windows API.

Retrieving all user SIDs can be done with via wmic useraccount get sid. Is there a way of getting this information via the Windows API instead?

Additionally, the wmic command returns the SIDs of all accounts, including disabled accounts - wmic useraccount get disabled,sid will show which accounts are disabled. It would be a bonus if a solution could advise on how to retrieve the SIDs of accounts that are not disabled, but this is not crucial.

Answer 1

You could use the function:

NET_API_STATUS NET_API_FUNCTION NetUserEnum(
  LPCWSTR servername,
  DWORD   level,
  DWORD   filter,
  LPBYTE  *bufptr,
  DWORD   prefmaxlen,
  LPDWORD entriesread,
  LPDWORD totalentries,
  PDWORD  resume_handle
);

with servername = NULL to enumerate local computer accounts, then use:

BOOL LookupAccountNameW(
  LPCWSTR       lpSystemName,
  LPCWSTR       lpAccountName,
  PSID          Sid,
  LPDWORD       cbSid,
  LPWSTR        ReferencedDomainName,
  LPDWORD       cchReferencedDomainName,
  PSID_NAME_USE peUse
);

to retrieve SID's.

Refer to https://learn.microsoft.com/en-us/windows/win32/api/lmaccess/nf-lmaccess-netuserenum and https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupaccountnamew for details and examples.

In function NetUserEnum, setting the parameter level=1 will return detailed information about user accounts, and the bufptr parameter will point to an array of USER_INFO_1 structures.

Examining the member usri1_flags of structure USER_INFO_1 with mask UF_ACCOUNTDISABLE give the status of account.

Following RbMm comment, note that specifying in function NetUserEnum the parameter level=3, the bufptr parameter will point to an array of USER_INFO_3 structures, that contains user RID's. The member usri3_user_id contains the relative ID (RID) of the user, and the member usri3_primary_group_id contains the RID of the Primary Global Group for the user. Using these values you don't need to call LookupAccountNameW.

The efficiency is boosted using suggestions from RbMm in the comments below.

Answer 2

for enumerate user accounts in SAM (Security Account Manager) database we can use or NetQueryDisplayInformation (more fast) or NetUserEnum (if we need more detail user information). or SAM api (fastest, include ntsam.h and link with samlib.lib )

note that if we have user (RID) we not need use LookupAccountName - this is very not efficient in this case (many heavy remote calls internal - LsaOpenPolicy, LsaLookupNames2, LsaClose . internal LsaLookupNames2 use anyway SAM api SamLookupNamesInDomain). really all what we need - first get domain SID and than append user RID to it. get domain SID we can by LsaQueryInformationPolicy with PolicyAccountDomainInformation for SID of the account domain (computer) - always exist and with PolicyDnsDomainInformation or PolicyPrimaryDomainInformation for get SID of the primary domain (exist only if computer part of Domain)

void PrintUsersInDomain(PUNICODE_STRING ServerName, PSID DomainSid)
{
    PWSTR szServerName = 0;

    if (ServerName)
    {
        if (ULONG Length = ServerName->Length)
        {
            szServerName = ServerName->Buffer;
            // if not null terminated
            if (Length + sizeof(WCHAR) < ServerName->MaximumLength || *(PWSTR)((PBYTE)szServerName + Length))
            {
                szServerName = (PWSTR)alloca(Length + sizeof(WCHAR));
                memcpy(szServerName, ServerName->Buffer, Length);
                *(PWSTR)((PBYTE)szServerName + Length) = 0;
            }
        }
    }

    UCHAR SubAuthorityCount = *GetSidSubAuthorityCount(DomainSid);
    ULONG DestinationSidLength = GetSidLengthRequired(SubAuthorityCount + 1);

    PSID UserSid = alloca(DestinationSidLength);
    CopySid(DestinationSidLength, UserSid, DomainSid);
    ++*GetSidSubAuthorityCount(UserSid);
    PULONG pRid = GetSidSubAuthority(UserSid, SubAuthorityCount);

    PVOID Buffer;
    ULONG Index = 0, ReturnedEntryCount;

    NET_API_STATUS status;

    do 
    {
        switch (status = NetQueryDisplayInformation(szServerName, 1, Index, 
            64, MAX_PREFERRED_LENGTH, &ReturnedEntryCount, &Buffer))
        {
        case NOERROR:
        case ERROR_MORE_DATA:
            if (ReturnedEntryCount)
            {
                PNET_DISPLAY_USER pndu = (PNET_DISPLAY_USER)Buffer;

                do 
                {
                    //if (!(pndu->usri1_flags & UF_ACCOUNTDISABLE))
                    {
                        *pRid = pndu->usri1_user_id;

                        PWSTR szSid;
                        if (ConvertSidToStringSidW(UserSid, &szSid))
                        {
                            DbgPrint("\t[%08x] %S %S\n", pndu->usri1_flags, pndu->usri1_name, szSid);
                            LocalFree(szSid);
                        }
                    }

                    Index = pndu->usri1_next_index;

                } while (pndu++, --ReturnedEntryCount);
            }

            NetApiBufferFree(Buffer);
        }
    } while (status == ERROR_MORE_DATA);
}

void PrintUsersInDomain_fast(PUNICODE_STRING ServerName, PSID DomainSid)
{
    SAM_HANDLE ServerHandle, DomainHandle = 0;

    //SAM_SERVER_ENUMERATE_DOMAINS|SAM_SERVER_LOOKUP_DOMAIN
    NTSTATUS status = SamConnect(ServerName, &ServerHandle, SAM_SERVER_LOOKUP_DOMAIN, 0);

    DbgPrint("SamConnect(%wZ) = %x\n", ServerName, status);

    if (0 <= status)
    {
        status = SamOpenDomain(ServerHandle, DOMAIN_READ|DOMAIN_EXECUTE, DomainSid, &DomainHandle);

        SamCloseHandle(ServerHandle);
    }

    if (0 <= status)
    {
        UCHAR SubAuthorityCount = *GetSidSubAuthorityCount(DomainSid);
        ULONG DestinationSidLength = GetSidLengthRequired(SubAuthorityCount + 1);

        PSID UserSid = alloca(DestinationSidLength);
        CopySid(DestinationSidLength, UserSid, DomainSid);
        ++*GetSidSubAuthorityCount(UserSid);
        PULONG pRid = GetSidSubAuthority(UserSid, SubAuthorityCount);

        PVOID Buffer;

        ULONG Index = 0, TotalAvailable, TotalReturned, ReturnedEntryCount;

        do 
        {
            if (0 <= (status = SamQueryDisplayInformation(DomainHandle,
                DomainDisplayUser,
                Index,
                2,
                0x10000,
                &TotalAvailable,
                &TotalReturned,
                &ReturnedEntryCount,
                &Buffer)))
            {
                if (ReturnedEntryCount)
                {
                    PSAM_DISPLAY_USER psdu = (PSAM_DISPLAY_USER)Buffer;
                    do 
                    {
                        //if (!(psdu->AccountControl & USER_ACCOUNT_DISABLED))
                        {
                            *pRid = psdu->Rid;

                            PWSTR szSid;
                            if (ConvertSidToStringSidW(UserSid, &szSid))
                            {
                                DbgPrint("\t[%08x] %wZ %S\n", psdu->AccountControl, &psdu->AccountName, szSid);
                                LocalFree(szSid);
                            }
                        }

                        Index = psdu->Index;

                    } while (psdu++, --ReturnedEntryCount);
                }
                SamFreeMemory(Buffer);
            }
        } while (status == STATUS_MORE_ENTRIES);

        SamCloseHandle(DomainHandle);
    }
}

void PrintUsers()
{
    LSA_HANDLE PolicyHandle;

    LSA_OBJECT_ATTRIBUTES ObjectAttributes = { sizeof(ObjectAttributes) };
    NTSTATUS status;
    if (0 <= (status = LsaOpenPolicy(0, &ObjectAttributes, POLICY_VIEW_LOCAL_INFORMATION, &PolicyHandle)))
    {
        union {
            PVOID buf;
            PPOLICY_DNS_DOMAIN_INFO pddi;
            PPOLICY_ACCOUNT_DOMAIN_INFO padi;
        };

        if (0 <= LsaQueryInformationPolicy(PolicyHandle, PolicyAccountDomainInformation, &buf))
        {
            DbgPrint("DomainName=<%wZ>\n", &padi->DomainName);
            if (padi->DomainSid) 
            {
                PrintUsersInDomain_fast(&padi->DomainName, padi->DomainSid);
                PrintUsersInDomain(&padi->DomainName, padi->DomainSid);
            }
            LsaFreeMemory(buf);
        }

        if (0 <= LsaQueryInformationPolicy(PolicyHandle, PolicyDnsDomainInformation, &buf))
        {
            DbgPrint("DomainName=<%wZ>\n", &pddi->Name);
            if (pddi->Sid) 
            {
                PrintUsersInDomain_fast(&pddi->Name, pddi->Sid);
                PrintUsersInDomain(&pddi->Name, pddi->Sid);
            }
            LsaFreeMemory(buf);
        }
        LsaClose(PolicyHandle); 
    }
}

typedef struct SAM_DISPLAY_USER {
    ULONG Index;
    ULONG Rid;
    ULONG AccountControl; /* User account control bits */
    UNICODE_STRING AccountName;
    UNICODE_STRING AdminComment;
    UNICODE_STRING FullName;
} *PSAM_DISPLAY_USER;

Answer 3

There are several ways.

A simple one is with NetQueryDisplayInformation

Test sample (Windows 10, VS 2015) =>

NET_API_STATUS NetStatus;
DWORD dwIndex = 0;
DWORD dwEntriesRequested = 0xFFFFFFFF;
DWORD dwPreferredMaximumLength = 0xFFFFFFFF;
DWORD dwReturnedEntryCount;
PVOID pNDU = NULL;
do {
    NetStatus = NetQueryDisplayInformation(NULL, 1, dwIndex, dwEntriesRequested, dwPreferredMaximumLength, &dwReturnedEntryCount, &pNDU);
    if (NetStatus != NERR_Success && NetStatus != ERROR_MORE_DATA)
        break;
    for (int i = 0; i < dwReturnedEntryCount; i++)
    {
        PNET_DISPLAY_USER NetDisplayUser = (PNET_DISPLAY_USER)(((LPBYTE)pNDU) + sizeof(NET_DISPLAY_USER) * i);              
        PSID pSID = ConvertNameToSID(NetDisplayUser->usri1_name);
        LPWSTR pszSid = NULL;
        ConvertSidToStringSid(pSID, &pszSid);
        BOOL bIsAccountDisabled = ((NetDisplayUser->usri1_flags & UF_ACCOUNTDISABLE) != 0) ? TRUE : FALSE;
        WCHAR wsBuffer[MAX_PATH];           
        wsprintf(wsBuffer, L"%4.4ld %-20.20ws SID : %ws - Disabled : %ws - Comment : %ws\n",
            NetDisplayUser->usri1_next_index,
            NetDisplayUser->usri1_name,
            pszSid,
            (bIsAccountDisabled ? L"True" : L"False"),
            NetDisplayUser->usri1_comment
        );
        LocalFree(pSID);

        OutputDebugString(wsBuffer);
        dwIndex = NetDisplayUser->usri1_next_index;                 
    }
    NetApiBufferFree(pNDU);
} while (NetStatus == ERROR_MORE_DATA);

PSID ConvertNameToSID(LPTSTR lpszName)
{
    WCHAR wszDomainName[256];
    DWORD dwSizeDomain = sizeof(wszDomainName) / sizeof(TCHAR);
    DWORD dwSizeSid = 0;
    SID_NAME_USE sidName;
    LookupAccountName(NULL, lpszName, NULL, &dwSizeSid, wszDomainName, &dwSizeDomain, &sidName);
    PSID pSid;
    pSid = (PSID)LocalAlloc(LPTR, dwSizeSid);
    LookupAccountName(NULL, lpszName, pSid, &dwSizeSid, wszDomainName, &dwSizeDomain, &sidName);
    return pSid;
}