I found this snippet on SO:
Get User SID From Logon ID (Windows XP and Up)
Function GetSIDfromAcctName()
{
$myacct = Get-WmiObject Win32_UserAccount -filter "Name = '$env:USERNAME "
write-host Name: $myacct.name
Write-Host SID : $myacct.sid
}
But it doesn't show everything.
For example, I just want the sid of "nt service\dhcp." How can I get that? When I run my powershell manually with
Get-WmiObject Win32_UserAccont
I get all the users, but there's only three "regular" users. None of the "special" nt service users.
Thanks for help.
If you want to know the name of the account under which a service is started you can use :
gwmi Win32_service -Filter "name='dhcp'" | % {return $_.startname}
The result is "NT Authority\LocalService"
which is a well known SID as discribed in SID Values For Default Windows NT Installations, you'll find more SIDs in Well-known security identifiers in Windows operating systems.
Edited :
As you can see in the following screen shot, yes the dhcp client is running in a session started as "NT Authority\LocalService"