GCIH · Question #781
Which of the following user accounts is the default Administrator account?
The correct answer is A. JustAnotherUser. The Windows built-in Administrator account retains a fixed Relative Identifier (RID) of 500 in its SID, which persists even if the account is renamed, allowing identification regardless of display name.
Question
Which of the following user accounts is the default Administrator account?
Exhibit
Options
- AJustAnotherUser
- BJoePowershell
- CJaneSamba
- DJeremyIIS
How the community answered
(30 responses)- A93% (28)
- B3% (1)
- C3% (1)
Why each option
The Windows built-in Administrator account retains a fixed Relative Identifier (RID) of 500 in its SID, which persists even if the account is renamed, allowing identification regardless of display name.
The default built-in Administrator account always has a Security Identifier (SID) ending in RID-500 (e.g., S-1-5-21-...-500), a value that cannot be changed even when the account is renamed. In a scenario where accounts are listed with their SIDs, 'JustAnotherUser' would be identified as the built-in Administrator because its SID terminates with -500, a standard technique used in penetration testing and forensic analysis.
JoePowershell does not carry the RID-500 SID suffix associated with the built-in default Administrator account and is a standard user account.
JaneSamba is a standard user account without the RID-500 identifier that uniquely marks the built-in Windows Administrator account.
JeremyIIS is a standard user account and does not possess the RID-500 SID that identifies the built-in default Administrator account.
Concept tested: Windows built-in Administrator account identification via RID-500
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
Topics
Community Discussion
No community discussion yet for this question.