How to Find a User’s SID in Active Directory

3.5K

Each object in the Active Directory environment, whether it is a user account, computer account or group, is assigned a unique identifier called a Security ID or SID.

An object’s SID in Windows looks like this:

S-1-5-21-482871169-3907970989-1540170358-1103

Why Windows uses SIDs?

Windows uses SIDs, rather than user (object) names, to control access to various resources such as files, shared printers, network folders, and so on.

• SID is assigned to an object when it is created (allocated by the domain controller that owns the RID Master FSMO role)
• It is not possible to change the assigned SID
• The Security Account Manager (SAM) database on the computer stores SIDs for local user accounts. The Active Directory database stores domain SIDs

SIDs in Active Directory vs Microsoft Entra ID

It is important for you to distinguish between AD SIDs and Microsoft Entra ID identifiers. In on-premises AD, every user, group, and computer account is assigned a Security Identifier (SID), which is used for access control and permissions.

But keep in mind that Microsoft Entra ID does not use traditional AD SIDs for cloud-only user accounts. Instead, each object is identified by a unique Object ID (GUID).

In hybrid environments synced with Microsoft Entra Connect, users may have both an AD SID and a Microsoft Entra ID Object ID. Depending on the workload, you may need to work with either identifier.

The methods we covered in this article apply to on-premises AD objects and hybrid accounts that originate from AD.

For example, in the following command the Id property represents the Microsoft Entra ID Object ID rather than an AD SID:

Connect-MgGraph

Get-MgUser -UserId user@contoso.com |
Select-Object Id,DisplayName,UserPrincipalName

Find SID of the logged on user

To find out the SID of the user currently logged on to the computer, run the command:

whoami /all

The command returns the domain name, the user’s SamAccountName, and their SID.

Use ADUC console to find SID of any object

Users can use the Active Directory Users and Computers (ADUC) graphical console to find out the SID of any object in the domain:

1. Run the ADUC snap-in (dsa.msc)
2. From the top menu, select View > Advanced Features
   
3. Open the properties of the required user (or another AD object) and go to the Attribute Editor tab. The SID is specified in the value of the ObjectSID user attribute
   

Getting SID value with PowerShell

Note that the SID is displayed in binary form and is not convenient to copy directly. Getting the user’s SID value from the command prompt is therefore much easier and more convenient in practice.

If the PowerShell module for Active Directory is installed on the computer, use the following command to get the user’s SID value:

Get-ADUser jbrion| select SamAccountName,SID

Find a user by known SID

In some cases, the reverse operation is required — to find a user by a known SID. In this case, use the SID as an argument to the Get-ADUser cmdlet:

Get-ADUser -Identity S-1-5-21-482871169-3907970989-1540170358-1108

If you don’t know what type of object the SID belongs to, you can use the Get-ADObject cmdlet to find the type and name of the Active Directory object by its ID:

$sid = 'S-1-5-21-482871169-3907970989-1540170358-1126'

Get-ADObject -Filter "objectSid -eq '$sid'" | Select-Object sAMAccountName, objectClass

In this example, we discovered that this is a computer account SID.

How to Check SIDHistory Attribute

In migration cases, you can face a situation when a user account may contain one or more historical SIDs stored in the SIDHistory attribute. Note that this attribute is commonly used during domain migrations and allows users to retain access to resources that still reference their previous SID.

In order to view the current SID and SIDHistory values for a user, run the following command:

Get-ADUser jbrion -Properties SIDHistory |
Select-Object SID,SIDHistory

In case the account has been migrated from another domain, the SIDHistory attribute may contain one or more legacy SIDs.

You can also check if a SID exists in the SIDHistory attribute using the command below:

Get-ADUser -Filter * -Properties SIDHistory |
Where-Object {$_.SIDHistory -contains 'S-1-5-21-482871169-3907970989-1540170358-1103'} |
Select-Object Name,SamAccountName

Find user SID with Principal.NTAccount class

If the RSAT-AD PowerShell module is not installed on the computer, it is possible to find out the user’s SID using the built-in System.Security.Principal.NTAccount class:

$UserName='jbrion'

$User = New-Object System.Security.Principal.NTAccount($UserName)

$SID = $User.Translate([System.Security.Principal.SecurityIdentifier])

$SID.Value

To find out a user name by its SID (reverse operation):

$objSID = New-Object System.Security.Principal.SecurityIdentifier ("S-1-5-21-482871169-3907970989-1540170358-1124")
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
$objUser.Value

Find User SID with PowerShell CIM

PowerShell CIM cmdlets provide you with a modern way to query user account information.

In order to get the SID of a local user account, you can use the command:

Get-CimInstance Win32_UserAccount -Filter "Name='jbrion' AND LocalAccount='True'" |
Select-Object Name,SID

If you need to get the SID of a domain user account, run the following command:

Get-CimInstance Win32_UserAccount -Filter "Name='jbrion' AND Domain='THEITBROS'" |
Select-Object Name,SID

In case you need to retrieve SIDs of local accounts only, you can also use the following command:

Get-LocalUser | Select-Object Name,SID

In case you need to get the SID of a specific local user, run the command:

Get-LocalUser jbrion | Select-Object Name,SID