JSI Tip 7278. SecTok freeware displays the user SID, name of the current token, and all SIDs/names of groups for that token.

After downloading, extract SecTok.exe.

When you type sectok /?, you receive:

SecTok V01.00.00cpp Joe Richards ([email protected]) November 2001Usage: SecTok  Ex1:    SecTok      Displays token info for current process This software is Freeware. Use it as you wish at your own risk. If you have improvement ideas, bugs, or just wish to say Hi, I receive email 24x7 and read it in a semi-regular timeframe. You can usually find me at [email protected]

When Joe typed SecTok, he received:

SecTok V01.00.00cpp Joe Richards ([email protected]) November 2001User: S-1-5-21-1275210071-789336058-1957994488-1109 - JOEHOME$jricha34Group: S-1-1-0 - EveryoneGroup: S-1-2-0 - LOCALGroup: S-1-5-11 - NT AUTHORITYAuthenticated UsersGroup: S-1-5-21-1275210071-789336058-1957994488-512 - JOEHOMEDomain AdminsGroup: S-1-5-21-1275210071-789336058-1957994488-513 - JOEHOMEDomain UsersGroup: S-1-5-21-1275210071-789336058-1957994488-518 - JOEHOMESchema AdminsGroup: S-1-5-21-1275210071-789336058-1957994488-519 - JOEHOMEEnterprise AdminsGroup: S-1-5-21-1275210071-789336058-1957994488-520 - JOEHOMEGroup Policy Creator OwnersGroup: S-1-5-32-544 - BUILTINAdministratorsGroup: S-1-5-32-545 - BUILTINUsersGroup: S-1-5-4 - NT AUTHORITYINTERACTIVEGroup: S-1-5-5-0-38867 - Logon Session

If a process that is running in the LocalSystem context runs SecTok, the display would look like:

SecTok V01.00.00cpp Joe Richards ([email protected]) November 2001User: S-1-5-18 - NT AUTHORITYSYSTEMGroup: S-1-1-0 - EveryoneGroup: S-1-5-11 - NT AUTHORITYAuthenticated UsersGroup: S-1-5-32-544 - BUILTINAdministrators