{"id":1551,"date":"2011-07-05T09:51:50","date_gmt":"2011-07-05T13:51:50","guid":{"rendered":"http:\/\/jdhitsolutions.com\/blog\/?p=1551"},"modified":"2011-07-05T09:51:50","modified_gmt":"2011-07-05T13:51:50","slug":"find-non-system-service-accounts-with-powershell-and-wmi","status":"publish","type":"post","link":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","title":{"rendered":"Find Non System Service Accounts with PowerShell and WMI"},"content":{"rendered":"<p>As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can't show you what account the service is running under. In old school terms, \"What is the service account?\" Fortunately you can get that information using WMI. Here's a query you can use that takes advantage of some slightly advanced WQL query syntax.<!--more--><\/p>\n<p>Since Windows XP, WMI has supported the LIKE operator in a query. This makes it easier to do a wildcard search in WMI.<\/p>\n<p>[cc lang=\"PowerShell\"]<br \/>\nPS S:\\> Get-WmiObject WIn32_process -filter \"Name Like 'chr%'\" | Select ProcessID,Name,WorkingSetSize,PageFaults,handles<\/p>\n<p>ProcessID      : 6912<br \/>\nName           : chrome.exe<br \/>\nWorkingSetSize : 140304384<br \/>\nPageFaults     : 559235<br \/>\nHandles        : 1436<\/p>\n<p>ProcessID      : 7352<br \/>\nName           : chrome.exe<br \/>\nWorkingSetSize : 61210624<br \/>\nPageFaults     : 113482<br \/>\nHandles        : 144<br \/>\n...<br \/>\n[\/cc]<\/p>\n<p>When using the LIKE operator, use the % as the wild card. But there are some advanced ways to use LIKE if you check out the MSDN <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa392263(v=VS.85).aspx\" target='blank'>documentation<\/a>. The most useful information is how to achieve a \"not like\" filter. Ideally, I want a WMI query to filter out all the service accounts that start with NT Authority as well as LocalSystem. This should leave me with \"regular\" user accounts.So here's a simple one liner to do just that:<\/p>\n<p>[cc lang=\"PowerShell\"]<br \/>\nPS C:\\> get-wmiobject win32_service -filter \"(StartName Like '[^NT Authority]%') AND (StartName <> 'localsystem')\" | Select name,Startname<\/p>\n<p>name                                                        Startname<br \/>\n----                                                        ---------<br \/>\nMSSQL$SQLEXPRESS                                            .\\sql<br \/>\nVeeam Backup and FastSCP Service                            .\\Jeff<br \/>\n[\/cc]<\/p>\n<p>These accounts are local to the machine. <\/p>\n<p>Remember that a WMI query uses legacy operators, not the PowerShell ones. And having WMI do the filtering is more efficient than bringing everything back to your computer and piping to Where-Object. You would really notice this when you start querying multiple remote machines. Use the SystemName property here to include the computer name.<\/p>\n<p>But now you can run a simple expression to scan computers and find where non system accounts are being used. This will only work for computers running Windows XP and later.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can&#8217;t show you what account the service is running under. In old school terms, &#8220;What is the service account?&#8221; Fortunately you can get that information using WMI. Here&#8217;s a query you can use that takes advantage of some&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[75,19],"tags":[534,304,547],"class_list":["post-1551","post","type-post","status-publish","format-standard","hentry","category-powershell-v2-0","category-wmi","tag-powershell","tag-service","tag-wmi"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator\" \/>\n<meta property=\"og:description\" content=\"As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can&#039;t show you what account the service is running under. In old school terms, &quot;What is the service account?&quot; Fortunately you can get that information using WMI. Here&#039;s a query you can use that takes advantage of some...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/\" \/>\n<meta property=\"og:site_name\" content=\"The Lonely Administrator\" \/>\n<meta property=\"article:published_time\" content=\"2011-07-05T13:51:50+00:00\" \/>\n<meta name=\"author\" content=\"Jeffery Hicks\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:site\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeffery Hicks\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"},\"author\":{\"name\":\"Jeffery Hicks\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"headline\":\"Find Non System Service Accounts with PowerShell and WMI\",\"datePublished\":\"2011-07-05T13:51:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"},\"wordCount\":332,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"keywords\":[\"PowerShell\",\"Service\",\"WMI\"],\"articleSection\":[\"PowerShell v2.0\",\"WMI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\",\"name\":\"Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\"},\"datePublished\":\"2011-07-05T13:51:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wmi\\\/1551\\\/find-non-system-service-accounts-with-powershell-and-wmi\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"PowerShell v2.0\",\"item\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/category\\\/powershell-v2-0\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Find Non System Service Accounts with PowerShell and WMI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/\",\"name\":\"The Lonely Administrator\",\"description\":\"Practical Advice for the Automating IT Pro\",\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\",\"name\":\"Jeffery Hicks\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"caption\":\"Jeffery Hicks\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","og_locale":"en_US","og_type":"article","og_title":"Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator","og_description":"As easy as Get-Service is to use in PowerShell, it has one limitation for IT Pros: it can't show you what account the service is running under. In old school terms, \"What is the service account?\" Fortunately you can get that information using WMI. Here's a query you can use that takes advantage of some...","og_url":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","og_site_name":"The Lonely Administrator","article_published_time":"2011-07-05T13:51:50+00:00","author":"Jeffery Hicks","twitter_card":"summary_large_image","twitter_creator":"@JeffHicks","twitter_site":"@JeffHicks","twitter_misc":{"Written by":"Jeffery Hicks","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#article","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"},"author":{"name":"Jeffery Hicks","@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"headline":"Find Non System Service Accounts with PowerShell and WMI","datePublished":"2011-07-05T13:51:50+00:00","mainEntityOfPage":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"},"wordCount":332,"commentCount":5,"publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"keywords":["PowerShell","Service","WMI"],"articleSection":["PowerShell v2.0","WMI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","url":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/","name":"Find Non System Service Accounts with PowerShell and WMI &#8226; The Lonely Administrator","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#website"},"datePublished":"2011-07-05T13:51:50+00:00","breadcrumb":{"@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jdhitsolutions.com\/blog\/wmi\/1551\/find-non-system-service-accounts-with-powershell-and-wmi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"PowerShell v2.0","item":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell-v2-0\/"},{"@type":"ListItem","position":2,"name":"Find Non System Service Accounts with PowerShell and WMI"}]},{"@type":"WebSite","@id":"https:\/\/jdhitsolutions.com\/blog\/#website","url":"https:\/\/jdhitsolutions.com\/blog\/","name":"The Lonely Administrator","description":"Practical Advice for the Automating IT Pro","publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jdhitsolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9","name":"Jeffery Hicks","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","url":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","caption":"Jeffery Hicks"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg"}}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":1625,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/1625\/get-process-owner\/","url_meta":{"origin":1551,"position":0},"title":"Get Process Owner","author":"Jeffery Hicks","date":"August 25, 2011","format":false,"excerpt":"I've been working on my second training course for Train Signal on managing Windows Server 2008 with Windows PowerShell, specifically the lesson on managing processes. I thought I'd share a little tidbit I worked out. In fact, I hope you'll stay tuned for other little goodies over the next several\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":100,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/100\/more-with-service-uptime\/","url_meta":{"origin":1551,"position":1},"title":"More with Service Uptime","author":"Jeffery Hicks","date":"February 16, 2007","format":false,"excerpt":"I knew I wasn't totally satisfied with my recent attempt at listing service uptime. I knew there was a more elegant solution and here it is: $s=Get-WmiObject -query \"Select name,processId,state from Win32_service where state='running'\"foreach ($item in $s) {$p=(Get-Process | Where {$_.id -eq $item.ProcessID}).StartTime$u=(get-date).Subtract($p)Write-Host $item.Name `t $u.Days day $u.hours hours $u.minutes\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":103,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/103\/more-with-process-and-service-uptime\/","url_meta":{"origin":1551,"position":2},"title":"More with Process and Service uptime","author":"Jeffery Hicks","date":"February 20, 2007","format":false,"excerpt":"Like most things scripting, there's usually more than one way to do things. I thought I had a nice solution for getting service uptime via WMI. But alas, there is an even easier way. PowerShell has a ConvertToDateTime method which will convert a WMI time to a standard date time\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":8143,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/8143\/solving-the-powershell-memory-challenge\/","url_meta":{"origin":1551,"position":3},"title":"Solving the PowerShell Memory Challenge","author":"Jeffery Hicks","date":"February 8, 2021","format":false,"excerpt":"I hope you tried your hand at this Iron Scripter PowerShell challenge on reporting memory usage. The basic challenge was to find the total percent of working set memory that a specific process or service is using. Here's how I approached it, with my usual disclaimer that my solution is\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2021\/02\/get-wspct.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":14,"url":"https:\/\/jdhitsolutions.com\/blog\/scripting\/14\/finding-service-uptime\/","url_meta":{"origin":1551,"position":4},"title":"Finding Service Uptime","author":"Jeffery Hicks","date":"January 10, 2006","format":false,"excerpt":"Ever wonder how long a particular service has been running? With WMI you can come pretty close to getting a handle on this. We start with Win32_Service to get the current process handle. Once we have that, we can query the Win32_Process class and get the creation time for that\u2026","rel":"","context":"In &quot;Scripting&quot;","block_context":{"text":"Scripting","link":"https:\/\/jdhitsolutions.com\/blog\/category\/scripting\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3497,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/3497\/resolving-sids-with-wmi-wsman-and-powershell\/","url_meta":{"origin":1551,"position":5},"title":"Resolving SIDs with WMI, WSMAN and PowerShell","author":"Jeffery Hicks","date":"October 15, 2013","format":false,"excerpt":"In the world of Windows, an account SID can be a very enigmatic thing. Who is S-1-5-21-2250542124-3280448597-2353175939-1019? Fortunately, many applications, such as the event log viewer resolve the SID to an account name. The downside, is that when you are accessing that same type of information from PowerShell, you end\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"win32_sid-fail","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2013\/10\/win32_sid-fail-1024x330.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2013\/10\/win32_sid-fail-1024x330.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2013\/10\/win32_sid-fail-1024x330.png?resize=525%2C300 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=1551"}],"version-history":[{"count":0,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1551\/revisions"}],"wp:attachment":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=1551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=1551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=1551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}