How to Convert a SID to a Username in PowerShell

Converting a SID to a Username with PowerShell

You can convert a SID (Security Identifier) to a username in PowerShell using the Get-LocalUser cmdlet paired with filtering, or by using the .NET System.Security.Principal.SecurityIdentifier class for more control. The fastest method depends on whether the account is local, domain-based, or already deleted.

PowerShell gives you several paths to the same answer. The method you choose depends on what you already know about the account and whether it still exists on the system.

Key Takeaways

Use Get-LocalUser | Where-Object {$_.SID -eq "S-1-5-21-..."} to find a local account by its SID directly in PowerShell.
The .NET SecurityIdentifier class can translate a SID to a username even if the account no longer exists, using the Translate() method.
Domain accounts require the full SID and may need the domain controller accessible; local accounts work on the machine where you run the command.
If the account is deleted, neither method will return a username — the SID becomes orphaned and cannot be resolved.

Using Get-LocalUser to Match a SID

The simplest approach for local accounts is to pipe Get-LocalUser through a filter. Open PowerShell and run:

Get-LocalUser | Where-Object {$_.SID -eq "S-1-5-21-3623811015-3361044348-30300820-1013"}

Replace the SID with the one you are looking for. PowerShell returns the full user object, including the Name property, which is the username. This works only for accounts that currently exist on the local machine. If you want only the username without the other properties, add | Select-Object -ExpandProperty Name to the end.

This method is fast and requires no additional setup, but it only searches the local machine. If you need to find a domain account or check a remote computer, you will need a different approach.

Using SecurityIdentifier to Translate SIDs

For more flexibility — especially with domain accounts or accounts that may no longer exist — use the .NET SecurityIdentifier class. This method works even when the account has been deleted, as long as the SID is still stored somewhere (like in file permissions or registry entries).

Run this command:

$sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-21-3623811015-3361044348-30300820-1013") $sid.Translate([System.Security.Principal.NTAccount]).Value

The output will be the account name in the format DOMAIN\Username or COMPUTERNAME\Username. This method queries Active Directory or the local SAM database depending on the SID structure. It is slower than Get-LocalUser but handles orphaned SIDs and domain accounts more reliably.

If the SID cannot be resolved — because the account was deleted or the domain is unreachable — PowerShell will return an error. Wrap the command in a try-catch block if you need to handle failures gracefully.

Checking Remote Computers for a SID

To search for a SID on a different computer, use Invoke-Command to run Get-LocalUser remotely:

Invoke-Command -ComputerName "REMOTE-PC" -ScriptBlock {Get-LocalUser | Where-Object {$_.SID -eq "S-1-5-21-3623811015-3361044348-30300820-1013"}}

This requires that you have administrative access to the remote computer and that PowerShell remoting is enabled. If remoting is not set up, you will see a connection error. The remote computer must be on the same network and reachable by name or IP address.

For domain accounts, the SecurityIdentifier method is often more reliable on remote machines because it queries Active Directory directly rather than relying on local user databases.

Understanding SID Structure and When Lookup Fails

A SID is a long string that starts with S-1 and contains numbers separated by hyphens. The last number is the RID (Relative Identifier), which uniquely identifies the account within its domain or local machine. Local accounts have SIDs starting with S-1-5-21- followed by three numbers that identify the computer.

Lookup fails in three common situations: the account has been deleted, the domain is offline or unreachable, or you have typed the SID incorrectly. If you are working with a SID from a file permission or registry entry, copy it exactly — even one digit wrong will cause the lookup to fail.

If you suspect the account was deleted, check the file or registry location where the SID came from. The SID itself is still valid and stored there, but no account object exists to translate it back to a name.

Exporting Multiple SIDs to Usernames

If you have many SIDs to convert, create a loop to process them all at once:

$sids = @("S-1-5-21-3623811015-3361044348-30300820-1013", "S-1-5-21-3623811015-3361044348-30300820-1014") foreach ($sid in $sids) { $sidObj = New-Object System.Security.Principal.SecurityIdentifier($sid) $name = $sidObj.Translate([System.Security.Principal.NTAccount]).Value [PSCustomObject]@{SID=$sid; Username=$name} }

This creates a table showing each SID and its corresponding username. You can pipe the output to Export-Csv to save the results to a file for later reference.

Frequently Asked Questions

What is the difference between a SID and a username?

A username is the human-readable name you use to log in. A SID is the unique identifier Windows uses internally to track permissions and ownership. One account has one username but the SID never changes, even if you rename the account.

Can I convert a SID if the account no longer exists?

Not with Get-LocalUser — that only finds existing accounts. The SecurityIdentifier.Translate() method may work if the SID is still referenced in Active Directory or if you have cached credentials, but most deleted accounts cannot be resolved.

Why does my SID lookup return an error?

The most common causes are a typo in the SID, the account being deleted, or the domain being unreachable. Double-check the SID character by character. If it is correct and the account should exist, verify that your computer can reach the domain controller.

Do I need administrator rights to look up a SID?

For local accounts on your own machine, no. For remote computers or domain accounts, yes — you need administrative credentials to query the remote system or Active Directory.

How do I find a SID if I only know the username?

Use Get-LocalUser -Name "username" | Select-Object SID for local accounts, or Get-ADUser -Identity "username" -Properties SID for domain accounts (requires the Active Directory module).

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.