How to get NT Account from the SID using PowerShell

Question

During my work on another question, I found that I need to get the localised account name for the NT AUTHORITY\Network Service account (who the &¤%@ localises account names??).

I have a work-around which involves running a bit of VBScript code, but since the rest of my project is in Powershell I think it would be "correct" to convert this code to Powershell (so I don't need to call VBScript from my Powershell, which I don't know how to do anyway...).

Any idea what this does, and how the same is done in Powershell?

Set objWMI = GetObject ("winmgmts:root\cimv2")
Set objSid = objWMI.Get ("Win32_SID.SID='S-1-5-20'")
Set MyDomain = objSid.ReferencedDomainName
Set MyAccount = objSid.AccountName

Answer 1

Something like this should do the trick;

$objSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-20") 
$objAccount = $objSID.Translate([System.Security.Principal.NTAccount]) 
$objAccount.Value

Output:

NT AUTHORITY\NETWORK SERVICE

---

If you wanted a bit more control you could stick with the WMI method and do something like this;

$acc = ([wmi]"Win32_SID.SID='S-1-5-20'")
$name = $acc.AccountName
$domain = $acc.ReferencedDomainName

$domain
$name
"{0}\{1}" -f $domain, $name

Output:

NT AUTHORITY
NETWORK SERVICE
NT AUTHORITY\NETWORK SERVICE

That way you now have the two components that make up the NT Account name separate same as your above script.

This method is probably the closest to your original example.