Monday 2 June 2014

Powershell - SID to User account

Usual issue of finding that the disk on a server is filling up.

One of the culprits can be the Recycle Bin which just gives you the SID of the offending user.

I found this useful link on the Microsoft site which describes how to find the information in the Registry.

It is a very short article which essentially states:
Use this tool at your own risk.
  1. Open Registry Editor and navigate to:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \ProfileList
  2. Under the ProfileList key, you will see the SIDs. By selecting each one individually, you can look at the value entry and see what user name is associated with that particular SID.
Worked great for me - I am also looking for a simple Powershell script to give me the information. Once I do I'll post it here.

To Powershell the query I found this useful script (just add the appropriate SID):

$objSID = New-Object System.Security.Principal.SecurityIdentifier `
 ("S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-27810")
 $objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
$objUser.Value

No comments:

Post a Comment