What a SID is and why you might need to convert it
A SID (Security Identifier) is a unique number Windows assigns to every user account on a computer. It looks like this: S-1-5-21-3623811015-3361044348-30300820-1013. If you have this number but not the username that goes with it, you can find the username by looking it up in Windows itself or checking your account records.
You might have a SID instead of a username if you're looking at old file permissions, system logs, or backup documentation. Windows stores file ownership as SIDs in the background, even though you see usernames on screen. When that documentation gets printed or exported, sometimes only the SID survives.
Key Takeaways
- Every Windows user account has a SID, which is a long number that Windows uses internally to track permissions and ownership.
- You can find the username for a SID by opening Command Prompt and running a single command that queries your local computer.
- If the SID belongs to a deleted account or a computer that no longer exists, the lookup will fail — in that case, check your backup files or account records instead.
- Domain accounts (used in offices) require a different lookup method than local accounts (used on home computers).
Finding a username from a SID on your own computer
Open Command Prompt as an administrator. Press the Windows key, type cmd, right-click "Command Prompt," and select "Run as administrator." Then paste this command and press Enter:
wmic useraccount where sid='S-1-5-21-3623811015-3361044348-30300820-1013' get name
Replace the SID in the command with the actual SID you're looking up. Windows will return the username in a few seconds. If nothing appears, the account either doesn't exist on this computer or has been deleted.
An alternative command that works on most Windows versions is:
Get-LocalUser | Where-Object {$_.SID -eq 'S-1-5-21-3623811015-3361044348-30300820-1013'} | Select-Object Name
This requires PowerShell instead of Command Prompt. Right-click the Windows key, select "Windows PowerShell (Admin)," paste the command, and press Enter. Both methods search only your current computer, so they won't find accounts from other machines.
Looking up a SID from a domain or network account
If the SID belongs to an account on a work network or domain (not your personal computer), the lookup is more complex. Ask your IT department or network administrator — they have tools that can search the entire domain for a SID and return the username when ready.
If you're trying to do this yourself and you have access to the domain, you can use Active Directory Users and Computers (available on domain-connected Windows Pro or Enterprise machines). Open it, search for the SID in the object properties, and the username will be listed there. This requires administrator access to the domain.
When the SID no longer has a matching username
If you run the lookup and get no result, the account has likely been deleted. Deleted accounts leave behind their SID in file permissions and logs, but Windows can no longer match it to a name. In this case, check whether you have older documentation — an employee roster, a backup file listing, or system records from before the account was removed.
You can also check the Security Event Log on the computer where the account existed. Open Event Viewer (press Windows key, type eventvwr.msc, press Enter), navigate to Windows Logs > Security, and search for the SID. The log may contain entries showing when the account was created or deleted, and sometimes the full name associated with it.
Reading SIDs from file properties
If you're looking at a file or folder and want to know who owns it, you don't need to convert the SID manually. Right-click the file, select Properties, go to the Security tab, click Edit, and look at the list of names. Windows displays the username next to the SID automatically. If the account is deleted, you'll see the SID itself with no name attached.
For a more detailed view, click Advanced on the Security tab. This shows the full SID for each account and whether it's still active on the system. Deleted accounts appear with a warning icon.
Keeping track of SIDs and usernames together
If you're managing multiple computers or accounts, write down both the username and the SID when you create or document an account. This saves time later if you need to troubleshoot permissions or audit who owned a file. You can export a list of all users and their SIDs by running this command in Command Prompt:
wmic useraccount get name,sid
This displays every local account on your computer paired with its SID. Save this output to a text file for your records, especially before deleting accounts or transferring files between computers.
Frequently Asked Questions
Can I find a username from a SID if the computer is offline or deleted?
Not with the commands above — they only work on a running computer. If the computer no longer exists, your only option is to check backups, old documentation, or account records from when the account was active. Some organizations keep audit logs that record SID-to-username mappings.
Why does Windows use SIDs instead of just usernames?
SIDs are permanent and unique, even if you rename an account. If Windows stored permissions by username, renaming an account would break all the file permissions tied to it. SIDs stay the same, so permissions survive a name change.
What if the SID starts with S-1-5-21 but the rest is different from my computer's SIDs?
That SID belongs to a different computer or domain. The numbers after S-1-5-21 are unique to each machine. You'll need access to that specific computer or domain to look up the username. If it's a work account, contact your IT department.
Can I use this method to find usernames on someone else's computer?
No. You need administrator access to the computer where the account exists. If you don't have that access, you can't run the lookup commands. This is a security feature — it prevents unauthorized people from discovering account names on systems they don't own.