SID & User Account

[teimourb]

SID and User Account
I am running XP-Pro SP2. As you know each user has a unique SID. If you delete a user and create a new one with the same name, it will get new SID and not the previous one.
Questions:
1. Where\How can I see the SIDs
2. How can tell which SID belongs to which User
3. How can I tell which SIDs belong to deleted users

Thanks.

[Darthtanion]

Re: SID & User Account

1- They are located in the registry

2- You have to know where to look in the registry as there are entries to identify which SID is associated with the user name. All user SID numbers will have 4 numbers starting with 10xx. There are also 2 other base SID numbers (500 and 501) that identify adminsitrator accounts that are set on the machine by default.

3- Same as #2 above, by cross referencing the registry entries. When a user account is deleted, the SID does not get recycled. It maintains its association with the account that it was originally assigned to. You might look at some of the registry tools available and see if any of them will automate the association for you. I do it manually most of the time when I examine a computer, but not often enough where I have the registry keys memorized as to their location.