Windows Fundamentals · beginner · ~11 min

Windows users, groups, and SIDs

Explain how Windows identifies accounts (SIDs), the key built-in groups, and local vs domain accounts.

Overview

Windows identifies every user/group/computer by a SID (names are labels). Built-in Administrator is RID 500; SYSTEM (S-1-5-18) outranks Administrator locally. Accounts are local (SAM) or domain (AD).

Why it matters

Enumerating Administrators and Domain Admins membership, and local vs domain accounts, is the start of Windows post-exploitation. Escalation targets are SYSTEM (local) and Domain Admin (domain). SIDs persist across renames, so they're what you track.

Core concepts

SID/RID. The real identity; Administrator = RID 500. SYSTEM (S-1-5-18). The OS account, stronger than Administrator locally. Local vs domain. SAM database vs Active Directory. High-value groups. Administrators, Domain Admins.

Lesson

Windows access control is built on security principals — users, groups, and computers — each identified by a SID.

SID, not name

A Security Identifier (SID) is the real identity, e.g. S-1-5-21-…-1001. Names are just labels; permissions are stored against SIDs. The last part (the RID) distinguishes accounts; the built-in Administrator is always RID 500.

Local vs domain accounts

  • Local accounts live in a single machine's SAM database.
  • Domain accounts live in Active Directory and work across every machine in the domain (covered in the AD track).

Key built-in groups

  • Administrators — full control of the machine.
  • Users — standard, limited.
  • SYSTEM (S-1-5-18) — the OS itself; more powerful than Administrator locally.
  • Domain Admins — administrators across the whole domain (the crown jewels).

Why a pentester cares

Enumerating who's in Administrators and Domain Admins, and which accounts are local vs domain, is step one of Windows post-exploitation. The goal of most escalation is to become SYSTEM locally or Domain Admin in the domain. SIDs (not names) are what you ultimately track, because renamed accounts keep their SID.

Summary

Windows security principals are tracked by SID, with well-known accounts like RID-500 Administrator and SYSTEM. Knowing local vs domain scope and who holds Administrators/Domain Admins is the foundation of Windows escalation.