0

Is there a universal way to get the principals BUILTIN\Users or BUILTIN\Power Users (specifically retrieve the name)

The obvious answer would be that I already have the names! However, they are called different things in different languages, so I'd like to find a way of retrieving this information without having to know the name in advance.

I've tried, in MS SQL

select * from sys.database_principals

which gives me the name and principal_id amongst other things

name                 principal_id  type  type_desc      default_schema_name
BUILTIN\Power Users  7             G     WINDOWS_GROUP  dbo
BUILTIN\Users        8             G     WINDOWS_GROUP  dbo

... but I'm assuming that these principal_ids aren't hard-coded and I can't rely on them always being 7 and 8

komodosp
  • 121
  • 6

1 Answers1

2

To get the actual name of the BUILTIN\Users group, you may query for the Well-Known SecurityIdentifier (SID) that is always assigned to the group. Note that the group name may be anything, as it can be renamed.

wmic /Node:"YourPCName" path win32_group WHERE SID="S-1-5-32-545"  


Caption                  Description                                                                                                  Domain   InstallDate  LocalAccount  Name             SID           SIDType  Status
YourPCName\UsersXXXRenamed  Users are prevented from making accidental or intentional system-wide changes and can run most applications  YourPCName               TRUE          UsersXXXRenamed  S-1-5-32-545  4        OK

Reference:

https://docs.microsoft.com/en-US/windows-server/identity/ad-ds/manage/understand-security-identifiers

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
  • @komodosp - Based on this answer you should be able to use these SIDs as invariants in your SQL query (`sys.database_principals` has a sid column`). It'll have to be formatted as varbinary, but you should be able to determine the correct values from your existing data. – Ben Thul Sep 07 '22 at 14:51
  • Thanks, that gets me the 'Users' bit but what about the 'BUILTIN' ? This could also be translated. – komodosp Sep 08 '22 at 14:42
  • Also, I was wrong to be looking in SQL... It appears that the system I was using had already added them there but they wouldn't be on a brand new system. – komodosp Sep 08 '22 at 15:58