What RID is given to an Administrator account on a Microsoft Windows machine?

In Windows, security principals (users, groups) are identified by a Security Identifier (SID), formatted

as S-1---. The RID (Relative Identifier) is the final component, unique

within a domain or machine. For local accounts:

RID 500: Assigned to the built-in Administrator account on every Windows machine (e.g., S-1-5-21-

-500).

Created during OS install, with full system privileges.

Disabled by default in newer Windows versions (e.g., 10/11) unless explicitly enabled.

RID 501: Guest account (e.g., S-1-5-21--501), limited access.

Technical Details:

Stored in SAM (C:\Windows\System32\config\SAM).

Enumeration: Tools like wmic useraccount or net user reveal RIDs.

Domain Context: Domain Admins use RID 512, but the question specifies a local machine.

Security Implications: RID 500 is a prime target for brute-forcing or pass-the-hash attacks (e.g.,

Mimikatz). CNSP likely advises renaming/disabling it (e.g., via GPO).

Why other options are incorrect:

A . 0: Reserved (e.g., Null SID, S-1-0-0), not a user RID.

C . 501: Guest, not Administrator.

D . 100: Invalid; local user RIDs start at 1000 (e.g., custom accounts).

Real-World Context: Post-compromise, attackers query RID 500 (e.g., net user Administrator) for

privilege escalation.

Reference: CNSP Official Study Guide (Windows Security); Microsoft SID Documentation.