Converting a SID to a Username on Windows

A SID (Security Identifier) is a unique number Windows assigns to every user account, but it is not human-readable. To find the username that belongs to a SID, you need to query Windows using built-in tools or the registry. The method depends on whether the account still exists on your machine, whether it is a local or domain account, and which Windows version you are using.

The fastest way for most people is to use the command line tool wmic or Get-LocalUser in PowerShell. Both can look up a SID and return the username in seconds. If those do not work, you can search the registry directly, though that requires more steps.

Key Takeaways

  • Use wmic useraccount where sid='S-1-5-21-...' get name in Command Prompt to convert a SID to a username when ready.
  • PowerShell's Get-LocalUser command can also translate a SID, but only for accounts that still exist on your computer.
  • If the account has been deleted, search the Windows registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList to find old SIDs and usernames.
  • Domain accounts require querying Active Directory, not the local machine, so you may need to contact your IT department or use a domain admin tool.
  • Third-party SID lookup tools exist but are not necessary — Windows built-in commands work on any machine without installation.

Using WMIC to Look Up a SID

The wmic command is the quickest method for most users. Open Command Prompt (not PowerShell), type the command exactly as shown, and replace the SID with the one you are looking for:

wmic useraccount where sid='S-1-5-21-3623811015-3361044348-30300820-1013' get name

Windows will return the username in the next line. If the account exists on your machine, the name appears when ready. If the SID does not match any account, the command returns nothing — no error message, just a blank result. This means the account either does not exist locally or the SID is typed incorrectly.

WMIC works on Windows 7 through Windows 11, though Microsoft has deprecated it in newer versions. It still functions, but PowerShell is becoming the preferred method.

Using PowerShell to Translate a SID

Open PowerShell as Administrator and use the Get-LocalUser command with the SID parameter:

Get-LocalUser -SID 'S-1-5-21-3623811015-3361044348-30300820-1013'

PowerShell returns the full user object, including the username, description, enabled status, and last logon time. This gives you more information than wmic, but it only works for accounts that currently exist on your machine. If the account was deleted, PowerShell returns an error.

PowerShell is available on Windows 10 and 11 by default. On Windows 7 or 8, you may need to install it separately, though most machines have it already.

Searching the Registry for Deleted Accounts

If the account no longer exists on your machine, the registry may still hold a record. Open Registry Editor by pressing Windows Key + R, typing regedit, and pressing Enter. Navigate to this location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

You will see a list of folders, each named with a SID starting with S-1-5-21. Look for the SID you are searching for. When you find it, click on it and look at the right panel for a value called ProfilePath. The path usually contains the username at the end — for example, C:\Users\JohnSmith tells you the username was JohnSmith.

This method works even after an account is deleted, because Windows keeps the profile folder and registry entry for a time. However, if the profile was manually removed or the machine was cleaned, the entry may be gone.

Finding Domain Account Usernames

If the SID belongs to a domain account (one managed by your organization's Active Directory server), local Windows tools will not find it. Domain accounts are stored on a server, not on your individual machine. You have two options: ask your IT department to look it up, or use a domain admin tool if you have access.

If you have domain admin credentials, you can use PowerShell with the Active Directory module. The command is:

Get-ADUser -Filter {objectSid -eq 'S-1-5-21-...'}

This requires the Active Directory module to be installed, which is not standard on regular Windows machines. Most people should contact their IT support instead.

Understanding SID Structure and Validity

A valid Windows SID always starts with S-1 and contains numbers separated by hyphens. Local user SIDs on a machine typically end with numbers like 1000, 1001, 1002, and so on. Built-in accounts like Administrator or Guest have fixed SIDs ending in 500 and 501. Domain accounts have much longer SIDs with more number groups.

If you are unsure whether a SID is valid, check that it follows this pattern and that it starts with S-1. If it does not, it is not a Windows SID. If you copied it from a log file or error message, double-check for typos — even one wrong digit will cause the lookup to fail.

What to Do If the Lookup Returns Nothing

If you run the wmic or PowerShell command and get no result, the SID either does not exist on your machine or is typed incorrectly. Check these things in order:

First, verify the SID is copied exactly as it appears — no extra spaces, no missing characters. Copy it again from the source and paste it into the command. Second, confirm the account has not been deleted. If it was deleted, use the registry method instead. Third, check whether it is a domain account; if so, you need to query Active Directory, not your local machine. Fourth, make sure you are running the command on the correct machine — a SID from one computer will not match accounts on another.

Frequently Asked Questions

Can I find a username from a SID if the account was deleted?

Yes, if the profile folder still exists. Check the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList for the SID, then look at the ProfilePath value to find the username. If the profile was removed, the registry entry may be gone too.

Why does wmic return nothing when I type the SID?

The SID either does not exist on your machine, is typed with a typo, or belongs to a domain account. Copy the SID again carefully and check for extra spaces. If it is a domain account, use Active Directory tools or contact IT instead.

Do I need admin rights to look up a SID?

No. The wmic command works as a regular user. PowerShell does not require admin rights to run Get-LocalUser, though opening Registry Editor is easier if you run it as Administrator.

What is the difference between a SID and a username?

A username is the name you type to log in. A SID is a unique number Windows uses internally to track permissions and ownership. One username always has one SID, but the SID stays the same even if you rename the account.

Can I use an online SID lookup tool?

Online tools exist but are not necessary. Windows built-in commands (wmic and PowerShell) work on any machine without downloading anything. Online tools may also be less find if they require you to upload sensitive information.