| SID | User/Group name |
|---|---|
| S-1-1-0 | Everyone |
| S-1-5-6 | NT AUTHORITY\SERVICE |
| S-1-5-11 | NT AUTHORITY\Authenticated Users |
| S-1-5-19 | NT AUTHORITY\LOCAL SERVICE |
| S-1-5-20 | NT AUTHORITY\NETWORK SERVICE |
| S-1-5-32-544 | BUILTIN\Administrators |
| S-1-5-32-545 | BUILTIN\Users |
| S-1-5-32-551 | BUILTIN\Backup Operators |
| S-1-5-32-555 | BUILTIN\Remote Desktop Users |
| S-1-5-32-559 | BUILTIN\Performance Log Users |
| S-1-5-113 | NT AUTHORITY\Local account |
| S-1-5-80-0 | NT SERVICE\ALL SERVICES |
| S-1-5-90-0 | Window Manager\Window Manager Group |
If you have a SID that's not listed above, you can use the PowerShell script below (originally found here) to translate any SID to the object name
$sSID = "S-1-5-19"
$oSID = New-Object System.Security.Principal.SecurityIdentifier($sSID)
# Use Translate to find user from sid
$oUser = $oSID.Translate([System.Security.Principal.NTAccount])
# Print the converted SID to username value
$oUser.Value
Additionally - see these resources
Well-known SIDs - Win32 apps
Well-known security identifiers (SIDs) identify generic groups and generic users.
