In a Windows system, a Security Identifier (SID) uniquely identifies each user and group. The SID format is:
S-1-5-21--
The Relative Identifier (RID) is the last component in the SID string.
According to Microsoft and CEH v13:
RID 500 → Built-in Administrator account
RID 501 → Guest account
RIDs > 1000 → Regular user accounts
In the given image, the SID:
s-1-5-21-1125394485-807628933-54978560-500chang
has a RID of 500, indicating the built-in administrator account.
From CEH v13:
Module 4: Enumeration
Topic: SID Enumeration
CEH v13 States:
“When enumerating Windows systems, the account with RID 500 is always the default Administrator account, unless renamed. Attackers often target this account due to its elevated privileges.”
Incorrect Options:
All others have RIDs not equal to 500 (e.g., 100, 652, 412, etc.)
[Reference:CEH v13 Study Guide – Module 4: Enumeration → Section: SID Enumeration & Windows Security AccountsMicrosoft Documentation on Well-known SIDs: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers, , , , , ==================================================================, ]
Submit