PowerShell: Return User SIDs from HKEY_USERS – Lab Core

This will return user SIDs using pattern matching. In the code below, S-1-5-21 and S-1-12-1 are the SID patterns we’re looking for. Also notice how we’re excluding SIDs with _Classes.

Code.ps1

# MrNetTek 
# eddiejackson.net 
# 11/14/2024
# free for public use 
# free to claim as your own

# Return SIDs that match specific patterns
$sids = Get-ChildItem -Path "Registry::HKEY_USERS" | Where-Object {
    $_.PSChildName -match "S-1-5-21|S-1-12-1" -and $_.PSChildName -notmatch "_Classes"
}

foreach ($sid in $sids) {
    
    # User SID
    $sidPath = $sid.PSChildName

    # Output
    Write-Host "User SID: $($sidPath)"

    # Do stuff here

    }