User SIDs

Map accounts to SIDs in ProfileList and hivelist, and list them with wmic useraccount.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist
The profile must be loaded first to show up in `HKEY_Users`.
  • Users — S-1-5-21-.
  • Local users — S-1-5-21-12.
  • Domain Users — S-1-5-21-13.
wmic useraccount get name,sid
Updated: 2026 Aug 19