nerdexam
EC-Council

312-50V10 · Question #634

Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs: From the above list identify the user account with System Administr

The correct answer is F. Chang. Windows assigns a fixed Relative Identifier (RID) of 500 to the built-in Administrator account; identifying this RID within a SID reveals the System Administrator.

Enumeration

Question

Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs:

From the above list identify the user account with System Administrator privileges.

Exhibit

312-50V10 question #634 exhibit

Options

  • AJohn
  • BRebecca
  • CSheela
  • DShawn
  • ESomia
  • FChang
  • GMicah

How the community answered

(25 responses)
  • B
    8% (2)
  • C
    4% (1)
  • F
    84% (21)
  • G
    4% (1)

Why each option

Windows assigns a fixed Relative Identifier (RID) of 500 to the built-in Administrator account; identifying this RID within a SID reveals the System Administrator.

AJohn

John's SID does not end in -500, indicating it is a standard user account and not the built-in Administrator.

BRebecca

Rebecca's SID does not end in -500, so it represents a standard user account without built-in Administrator privileges.

CSheela

Sheela's SID does not end in -500, identifying it as a regular user account rather than the system Administrator.

DShawn

Shawn's SID does not end in -500, meaning it is a standard created user without built-in Administrator rights.

ESomia

Somia's SID does not end in -500, so it is a normal user account and not the built-in Administrator.

FChangCorrect

In Windows, every SID ends with a Relative Identifier (RID). The built-in Administrator account is always assigned RID-500, regardless of the machine or its name. Chang's SID ends with -500, which uniquely identifies it as the built-in System Administrator account. All other accounts with RIDs of 1000 or higher are standard user accounts created after installation.

GMicah

Micah's SID does not end in -500, identifying it as a standard user account rather than the built-in Administrator.

Concept tested: Windows SID RID-500 Administrator account identification

Source: https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers

Topics

#SID enumeration#Windows administrator SID#SIDExtractor#user account identification

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice