sid::lookup
can be used to lookup an object by its SID or name. It has the following command line arguments:
/sid
: the security identifier value to lookup/name
: thesAMAccountName
of the account to lookup/domain
: the domain name. If not specified, the current domain will be used
mimikatz # sid::lookup /name:m3g9tr0n
Name : m3g9tr0n
Type : User
Domain: hacklab
SID : S-1-5-21-2725560159-1428537199-2260736313-1730
mimikatz # sid::lookup /sid:S-1-5-21-2725560159-1428537199-2260736313-1730
SID : S-1-5-21-2725560159-1428537199-2260736313-1730
Type : User
Domain: hacklab
Name : m3g9tr0n
mimikatz # sid::lookup /sid:S-1-5-21-2725560159-1428537199-2260736313
SID : S-1-5-21-2725560159-1428537199-2260736313
Type : Domain
Domain: hacklab
Name :