# MSRPC SID Brute Forcing

> Enumerate valid Windows SIDs via MSRPC using brute-force techniques to discover user accounts, groups, and domain objects through the LSA and SAMR interfaces.

- **URL:** https://hackindex.io/services/msrpc/enumeration/msrpc-sid-brute-forcing
- **Path:** MSRPC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/msrpc/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-07-10

SID brute-forcing uses the MS-LSAT protocol to resolve RIDs into account names. Every Windows domain has a fixed base SID. User accounts, groups, and built-in objects are assigned sequential RIDs from 500 upward. By cycling RIDs through the lookupsids named pipe, you enumerate all domain accounts and groups without any prior wordlist. The base SID comes from a prior lsaquery call. impacket-lookupsid handles that automatically.

- **Anonymous brute-forcing** resolves RIDs without credentials when null SMB sessions are allowed.
- **Authenticated brute-forcing** returns more results, including accounts hidden from anonymous access.
- **Well-known RIDs** start at 500 (Administrator), 501 (Guest), with custom accounts around RID 1000.
- **Output filtering** removes unresolved RIDs to produce a clean user and group list for spraying.

Use this technique early in AD enumeration when you have no user list and need one. RID 500 is always Administrator, RID 501 is Guest. Custom accounts typically start around RID 1000.

## Impacket lookupsid

Anonymous brute:

```bash
impacket-lookupsid anonymous@$TARGET_IP
```

Each resolved line looks like: `DOMAIN\accountname (SidTypeUser)`. SidTypeUser indicates a user account. SidTypeGroup or SidTypeAlias indicates a group. Unresolved RIDs return as None. Anonymous access works when the DC allows null SMB sessions, a configuration common in older Windows environments but disabled by default on modern DCs. If the null session is blocked, the tool returns an access denied error with no results. Move to the authenticated variant.

Authenticated:

```bash
impacket-lookupsid $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP | tee output.txt
```

Authenticated brute-forcing returns more results than anonymous. You see accounts that anonymous access would miss, including accounts with restricted visibility. Service accounts appear here too. Note the names, they are targets for spraying or Kerberoasting. Writing output to a file lets you filter and reuse the list across multiple tools. Extract resolved entries:

```bash
grep -v "None" output.txt
```

The grep removes unresolved RIDs and leaves a clean list of account and group names. Scan for service accounts and accounts with naming patterns that suggest automation or legacy use. Disabled accounts hint at naming conventions in use for active accounts. This username list feeds directly into password spraying and AS-REP roasting. Generating hundreds of RID lookups in quick succession is noisy. In environments with detailed LSARPC auditing, this triggers event log entries. Prefer a single authenticated run over repeated anonymous attempts.

Valid usernames from SID brute-forcing feed directly into [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying). To confirm which discovered accounts have pre-authentication disabled, see [Kerberos Valid User Enumeration](https://hackindex.io/services/kerberos/enumeration/kerberos-valid-user-enumeration).

## References

- [Impacket repository](https://github.com/fortra/impacket) - lookupsid.py for SID enumeration