In windows (again I know …. ) sometimes you get reference to removed users ( and sometimes not so removed) in mmc and secpol looking like this :
To check the SIDs of users for some obscure bug like I had today use:
wmic useraccount get name,sid
That’s it ..
( ofcourse you can filter it with )
wmic useraccount get name,sid | find “Administrator” /I