In windows (again I know …. ) sometimes you get reference to removed users ( and sometimes not so removed) in mmc and secpol looking like this :
S-1-5-21-123456789-3881959548-123456789-500
To check the SIDs of users for some obscure bug like I had today use:
wmic useraccount get name,sid
That’s it ..
( ofcourse you can filter it with )
wmic useraccount get name,sid | find “Administrator” /I
nJoy 😉