Get SID from Username and Username from SID using WMI Queries

Windows stores per-user identity internally as a SID (Security Identifier) rather than a username, which matters when you need to edit a specific user’s registry hive under HKEY_USERS or HKEY_CURRENT_USER and only know one of the two.

List Every Account and Its SID

wmic useraccount get name, sid, status

Get the SID for a Specific Username

wmic useraccount where name='username' get name, sid, status

Get the Username for a Specific SID

wmic useraccount where sid='S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-1001' get name

Replace the example SID with the actual one you’re looking up. Note that wmic is deprecated in current Windows builds in favour of PowerShell — the equivalent command there is Get-CimInstance -ClassName Win32_UserAccount | Select-Object Name, SID, Status, which works identically if wmic isn’t available on newer systems.

Filtering the PowerShell Version

The Get-CimInstance equivalent can be filtered the same way as the wmic examples above, using a -Filter parameter instead of where:

Get-CimInstance -ClassName Win32_UserAccount -Filter "Name='username'" | Select-Object Name, SID, Status
Get-CimInstance -ClassName Win32_UserAccount -Filter "SID='S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-1001'" | Select-Object Name

Worth knowing if you’re setting this up today: wmic.exe is removed by default starting with recent Windows 11 feature updates, though it can currently still be reinstalled as an optional Feature on Demand if you specifically need it. Microsoft has flagged it for eventual full removal with no reinstall option in a future release, so it’s worth standardising on the Get-CimInstance version above for anything you expect to keep using long-term.

Why You’d Need This

The most common reason to go from username to SID is loading another user’s registry hive with reg load, which requires the SID-based path (HKEY_USERS\S-1-5-21-...) rather than the username — useful for editing settings in a profile that isn’t the one currently logged in, such as during offline profile cleanup or remote troubleshooting.

Resources

• query