powershellwindows-7

How do I get a local NT Service SID using Powershell?


I found this snippet on SO:

Get User SID From Logon ID (Windows XP and Up)

Function GetSIDfromAcctName()
{
$myacct = Get-WmiObject Win32_UserAccount -filter "Name = '$env:USERNAME " 
write-host Name: $myacct.name
Write-Host SID : $myacct.sid
}

But it doesn't show everything.

For example, I just want the sid of "nt service\dhcp." How can I get that? When I run my powershell manually with

Get-WmiObject Win32_UserAccont

I get all the users, but there's only three "regular" users. None of the "special" nt service users.

Thanks for help.


Solution

  • If you want to know the name of the account under which a service is started you can use :

    gwmi Win32_service -Filter "name='dhcp'" | % {return $_.startname}
    

    The result is "NT Authority\LocalService" which is a well known SID as discribed in SID Values For Default Windows NT Installations, you'll find more SIDs in Well-known security identifiers in Windows operating systems.


    Edited : As you can see in the following screen shot, yes the dhcp client is running in a session started as "NT Authority\LocalService"

    enter image description here