Identifying Local Administrator Account

by Sep 20, 2021

There are a few default accounts on Windows machines such as the local “Administrator” account. While this account exists by default, its name can vary from culture to culture, and its name can also be renamed.

To always identify the local Administrator account regardless of its name, search local accounts by SID (security identifier). The local Administrator account SID always starts with ‘S-1-5-‘ and uses the RID ‘-500’:

PS> Get-Localuser | Where-Object Sid -like 'S-1-5-*-500'

Name          Enabled Description
----          ------- ----------- 
Administrator False   Built-in account for administering the computer/domain  

Twitter This Tip! ReTweet this Tip!