How to Find User UID and GUID

Introduction

UID (User Identifier) and GUID (Globally Unique Identifier) are essential components for user management in operating systems, databases, and software development. Understanding these identifiers helps in managing permissions, authentication, and security configurations effectively. This guide covers how to locate these identifiers on Windows, Mac, Linux, and cloud-based services.

Understanding UID and GUID

What is the difference between UID and GUID?

UID (User Identifier): A unique numerical identifier assigned to each user account in Unix-based systems (Linux and macOS). It is used to determine user permissions and ownership.
GUID (Globally Unique Identifier): A 128-bit unique identifier used mainly in Windows environments and Active Directory. Unlike UID, GUID is not just numerical but also hexadecimal, ensuring uniqueness across distributed systems.

UIDs are particularly useful for defining user permissions in Linux systems, where they are referenced in access control lists and process ownership. GUIDs, on the other hand, are often used in distributed applications, ensuring that unique IDs are maintained across different servers, applications, and databases.

Understanding these identifiers is critical for managing security, especially in enterprise environments where user authentication, resource access, and permissions need to be precisely controlled.

Finding UID and GUID on Different Platforms

Linux and macOS: Finding UID

Using Terminal Commands

To find the UID of the currently logged-in user, open a terminal and run:

id -u

This command returns the UID of the current user.

To find the UID of a specific user, use:

id -u username

Replace username with the actual user’s name. This is useful for system administrators who need to check UIDs for multiple users.

Checking UID in System Files

All user accounts and their UIDs are listed in the /etc/passwd file. To view this file, run:

cat /etc/passwd

Each line represents a user account, with fields separated by colons (:). The third field in each line is the UID.

Windows: Locating GUID

Using PowerShell

Windows users primarily deal with GUIDs in Active Directory. To find the GUID of a specific user, use PowerShell:

Get-ADUser -Identity username | Select-Object ObjectGUID

This requires the Active Directory module, which is typically available on domain-joined machines.

Using Command Prompt

An alternative method to find a user’s unique identifier in Windows is by retrieving their Security Identifier (SID), which maps to GUIDs in Active Directory. Run:

wmic useraccount where name='username' get SID

This will output the SID, which can be referenced in security policies.

Checking the Registry

For users with administrative privileges, GUIDs can also be found in the Windows Registry:

Open regedit (Registry Editor).
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
Each profile entry contains a GUID, which corresponds to a user’s profile.

Cloud-Based Services

AWS

In AWS, IAM (Identity and Access Management) does not use traditional UIDs but rather unique ARNs (Amazon Resource Names) to identify users. To list all users:

aws iam list-users

This provides user details, including unique identifiers associated with each IAM user.

Azure

Azure AD assigns GUIDs to each user. To retrieve a user’s GUID, use:

Get-AzureADUser -ObjectId user@domain.com | Select-Object ObjectId

This command extracts the unique Object ID associated with an Azure AD user.

Google Cloud

Google Cloud IAM allows administrators to retrieve user details, including unique identifiers. To list users:

gcloud iam service-accounts list

This provides details on IAM-managed users and their associated IDs.

Changing UID or GUID

Linux/macOS

UIDs can be changed using the usermod command, but caution is required:

sudo usermod -u newUID username

Changing a UID can cause permission issues with existing files owned by the user. It is recommended to update file ownerships accordingly:

sudo find / -user oldUID -exec chown -h newUID {} \;

Windows (GUIDs in AD)

GUIDs in Active Directory are immutable. However, user accounts can be re-created with a new GUID if necessary, and existing permissions migrated.

Security Risks of UID/GUID Exposure

Privilege Escalation: If an attacker gains access to a known UID, they might exploit misconfigured permissions to escalate privileges.
Persistent Identity Tracing: GUIDs in Active Directory allow user tracking across systems, which can be exploited for targeted attacks.
Misconfiguration Risks: Incorrectly changing a UID can cause permission mismatches, leading to unauthorized access or system errors.

Best Practices

To mitigate security risks, consider the following best practices:

Audit UID/GUID usage regularly to detect unauthorized access.
Implement Least Privilege Principle (LPP) to restrict user permissions to only what is necessary.
Restrict access to UID/GUID details by ensuring directory services and security policies limit exposure.
Use Multi-Factor Authentication (MFA) to protect accounts even if an identifier is exposed.
Encrypt sensitive identity information within Active Directory or identity management solutions.

Conclusion

Understanding how to locate and manage UIDs and GUIDs is essential for system administrators, security professionals, and IT personnel. These identifiers play a crucial role in authentication, access control, and security policies. By following best practices and utilizing proper security measures, organizations can protect their systems from unauthorized access and maintain secure identity management protocols.