312-50V10 · Question #634
Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs: From the above list identify the user account with System Administr
The correct answer is F. Chang. Windows assigns a fixed Relative Identifier (RID) of 500 to the built-in Administrator account; identifying this RID within a SID reveals the System Administrator.
Question
Peter extracts the SIDs list from Windows 2000 Server machine using the hacking tool "SIDExtractor". Here is the output of the SIDs:
From the above list identify the user account with System Administrator privileges.
Exhibit
Options
- AJohn
- BRebecca
- CSheela
- DShawn
- ESomia
- FChang
- GMicah
How the community answered
(25 responses)- B8% (2)
- C4% (1)
- F84% (21)
- G4% (1)
Why each option
Windows assigns a fixed Relative Identifier (RID) of 500 to the built-in Administrator account; identifying this RID within a SID reveals the System Administrator.
John's SID does not end in -500, indicating it is a standard user account and not the built-in Administrator.
Rebecca's SID does not end in -500, so it represents a standard user account without built-in Administrator privileges.
Sheela's SID does not end in -500, identifying it as a regular user account rather than the system Administrator.
Shawn's SID does not end in -500, meaning it is a standard created user without built-in Administrator rights.
Somia's SID does not end in -500, so it is a normal user account and not the built-in Administrator.
In Windows, every SID ends with a Relative Identifier (RID). The built-in Administrator account is always assigned RID-500, regardless of the machine or its name. Chang's SID ends with -500, which uniquely identifies it as the built-in System Administrator account. All other accounts with RIDs of 1000 or higher are standard user accounts created after installation.
Micah's SID does not end in -500, identifying it as a standard user account rather than the built-in Administrator.
Concept tested: Windows SID RID-500 Administrator account identification
Source: https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers
Topics
Community Discussion
No community discussion yet for this question.
