Zoho Banner September 2011

Many organisations choose to rename the Built-in Administrator account for the domain for security reasons.  Whether or not renaming the account provides any real protection is the matter of some debate.  What is clear is that any hacker worth his or her salt is not going to be fooled by the rename, because the account has a well known security identifer:

SID: S-1-5-21domain-500

I was working on something the other day and needed to find the Built-in Administrator account using Powershell.  It wasn’t quite as straightforward as I thought it would be.  Anyway, here’s what I came up with:

$BA = (Get-ADDomain).domainsid 
$BA = $BA.ToString() + "-500" 
Get-ADUser -Identity $BA

As you can see it basically involves grabbing the domain SID, adding on the well-known identifier “-500″ and then searching for the account based on the concatenanted string. 

I can’t help thinking there must be an easier method, so if you have one please post a comment here.

6 Comments

  1. ldap389 says:

    Hello,

    I use this method:

    Get-ADUser -filter {isCriticalSystemObject -eq $true -and Admincount -eq 1 -and SamAccountName -ne “krbtgt”}

    But I think yours is more accurate :-)

    Regards

  2. Kevin says:

    As always Tony super useful command.
    Thanks

  3. bigstoo says:

    Get-aduser -filter | where {$_.sid -match ’500′}

  4. Lee says:

    Awesome, thanks!

  5. Vico says:

    bigstoo’s line is good but needed a slight fix to be like this Get-aduser -filter * | where {$_.sid -match “-500″}
    and it should work fine. Thanks also for the original poster. great work

Leave a Reply