Determine administrator account 1

[tvbruwae]

Hi

Is there a procedure or tool that can help me to determine the built-in administrator account on NT and W2K systems? On most of these systems the local admin account has been renamed and its comments have been removed so it's rather hard to find out which admin account is the built-in one.

Thanks.

Tim

 

[funkygibbon]

The built in Administrator account always has a SID ending in 500, e.g. S-1-2-34-1234567890-123456789-123456789-500

So, one way to do it is to open up regedit and navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

There'll be a list of SIDs there for every account that has interactively logged on to the machine. The one ending in -500 is your admin account. Have a look to see which user name is associated with that account in the ProfileImageFlag key.

HTH!

 

[tvbruwae]

I found the keys and SIDs, but I can't associate the username with them since the ProfileImageFlag key does not seem to exist. Or is it located in another registry key?

 

[funkygibbon]

Hmmm, OK then. That would imply that the local admin account has never logged on. Never mind, plan B. There's a command line utility called sid2user that will give you the account name. You can download it from here:

http://www.ntbugtraq.com/default.asp?pid=55&did=6

and plug in the SID ending in -500. That should do it.

The syntax will be something like
sid2user 2 34 1234567890 123456789 123456789 500
(based on the SID I used above).

See how that goes!

 

[tvbruwae]

Found the tools and they work great. Thanks a lot, you' ve been a great help!

 

[WMSTECH]

I thought this was interesting so I tried it, and found that you in fact can get this info from the Registry.

When you have expanded ProfileList and have the list of SID keys, open one of them and look at the value named ProfileImagePath. Scroll right and you'll see that it contains the path to the account profile, such as "%SystemRoot%\Profiles\Administrator". I think that's what we're talking about, since that identifies the user.

Now I'm going to try sid2user. Good tip!

 

[tvbruwae]

The last part of the ProfileImagePath does indeed indicate the associated username. However, it always points to the SID's profile folder that was created upon first login of the user. When the username is changed (renamed), both the folder and the registry key still point to the original username. That's why I couldn't use this approach.