Which command-line tool can I use to determine the SID that a Windows NT 4.0 system process is using? (Windows 2000 and later OSs display this information on the Processes tab—in the User Name column—in Task Manager.)
The Microsoft Windows NT Server 4.0 Resource Kit PuList command-line tool shows the process identfier (PID) and SID of every process running on a Windows system. Figure 1 shows sample PuList output.
Sysinternals' Process Explorer is a more advanced GUI tool that performs the same function. For more information about Process Explorer, see http://www.sysinternals.com/ntw2k/freeware/procexp.shtml.