Skip to content
HackIndex.io

MSRPC SID Brute Forcing

3 min read Created Jan 4, 2026 Last updated Jul 10, 2026

SID brute-forcing uses the MS-LSAT protocol to resolve RIDs into account names. Every Windows domain has a fixed base SID. User accounts, groups, and built-in objects are assigned sequential RIDs from 500 upward. By cycling RIDs through the lookupsids named pipe, you enumerate all domain accounts and groups without any prior wordlist. The base SID comes from a prior lsaquery call. impacket-lookupsid handles that automatically.

  • Anonymous brute-forcing resolves RIDs without credentials when null SMB sessions are allowed.
  • Authenticated brute-forcing returns more results, including accounts hidden from anonymous access.
  • Well-known RIDs start at 500 (Administrator), 501 (Guest), with custom accounts around RID 1000.
  • Output filtering removes unresolved RIDs to produce a clean user and group list for spraying.

Use this technique early in AD enumeration when you have no user list and need one. RID 500 is always Administrator, RID 501 is Guest. Custom accounts typically start around RID 1000.

Impacket lookupsid

Anonymous brute:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid anonymous@$TARGET_IP
Explain command
$TARGET_IP Target IP address passed as argument to the script.

Each resolved line looks like: DOMAIN\accountname (SidTypeUser). SidTypeUser indicates a user account. SidTypeGroup or SidTypeAlias indicates a group. Unresolved RIDs return as None. Anonymous access works when the DC allows null SMB sessions, a configuration common in older Windows environments but disabled by default on modern DCs. If the null session is blocked, the tool returns an access denied error with no results. Move to the authenticated variant.

Authenticated:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP | tee output.txt
Explain command
$DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP Target credentials and host in DOMAIN/user:pass@IP format for SMB auth

Authenticated brute-forcing returns more results than anonymous. You see accounts that anonymous access would miss, including accounts with restricted visibility. Service accounts appear here too. Note the names, they are targets for spraying or Kerberoasting. Writing output to a file lets you filter and reuse the list across multiple tools. Extract resolved entries:

┌──(kali㉿kali)-[~]
└─$ grep -v "None" output.txt
Explain command
-v Invert match, printing lines that do NOT match the pattern.
"None" The pattern string to match and exclude from output.
output.txt Input file to search through.

The grep removes unresolved RIDs and leaves a clean list of account and group names. Scan for service accounts and accounts with naming patterns that suggest automation or legacy use. Disabled accounts hint at naming conventions in use for active accounts. This username list feeds directly into password spraying and AS-REP roasting. Generating hundreds of RID lookups in quick succession is noisy. In environments with detailed LSARPC auditing, this triggers event log entries. Prefer a single authenticated run over repeated anonymous attempts.

Valid usernames from SID brute-forcing feed directly into AD Password Spraying. To confirm which discovered accounts have pre-authentication disabled, see Kerberos Valid User Enumeration.

References