Finding the SID of a domain user

Content Authoring
1

(imported topic written by gabattil91)

Hi All,

I would like to ask some help to read the SID ID of a domain user. The goal would be to check the size of the machine owner’s Recycle Bin. I can do that when a user is logged on, but the machine owner and the logged on user is not necessarily the same person

Here is the code which will show the size of the logged on user’s Recycle Bin. :

if name of it of logged on user != “” Then (if exists folder (concatenation “” of (“C:\RECYCLER”;(substrings separated by “” of following text of first “RECYCLER” of (value “Path” of key “Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket@” of (key whose ((it = name of current user as lowercase OR it starts with name of current user as lowercase & “@” ) of (it as string as lowercase) of value “Logon User Name” of key “Software\Microsoft\Windows\CurrentVersion\Explorer” of it) of key “HKEY_USERS” of registry) as string) whose (it contains “RECYCLER”)))) then sum of sizes of files of folder (concatenation “” of (“C:\RECYCLER”;(substrings separated by “” of following text of first “RECYCLER” of (value “Path” of key “Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket@” of (key whose ((it = name of current user as lowercase OR it starts with name of current user as lowercase & “@” ) of (it as string as lowercase) of value “Logon User Name” of key “Software\Microsoft\Windows\CurrentVersion\Explorer” of it) of key “HKEY_USERS” of registry) as string) whose (it contains “RECYCLER”))))as string else (“Recycle Bin does not exist”)) else (“Nobody is Logged On”)

So the question…How could I get the SID ID of a domain user?

Thanks for the help

Regards,

Attila

2

(imported comment written by BenKus)

Hi Attila,

How are you going to get the domain name of the computer owner?

Ben

3

(imported comment written by gabattil91)

Hi Ben,

This information is dynamically upgraded by a management tool in the firm.

So lets say this is a REG_SZ value which is stored on the follwing path:

HKLM\SOFTWARE\Company\Inventory

MachineOwner: REG_SZ

Thank you

Attila

4

(imported comment written by SystemAdmin)

This should do the trick for you…component string of sid of security account “user”. I use this a lot to get the current user SID to check their user hive in the registry by doing component string of sid of security account (name of current user). So you could probably modify this for your purposes:

value “value” of key “(HKU” & component string of sid of security account (name of current user) & “\Software\Key”) of registry

5

(imported comment written by BenKus)

Interesting… I ad forgotten about this ‘security account’ inspector… Thanks, BrianK…

Attila, see if this works:

q: sum of sizes of files of (folders (“C:\recycler” & it)) of component strings of sids of security accounts (values “MachineOwner” of keys “HKLM\SOFTWARE\Company\Inventory” of registry as string)

Ben

6

(imported comment written by gabattil91)

Hi Ben and BrianK,

This is exactly what I was searching for. It is working like a charm.

Thank you for your help!

Cheers

Attila