🧠 Active Directory - RID Cycling

What is it?

• Concept: Every AD principal’s SID is the domain SID plus a sequential Relative ID (RID) suffix — well-known built-in accounts always land on predictable RIDs (500 = Administrator, 501 = Guest, 502 = krbtgt, 1000+ = regular accounts). Given the domain SID and a way to resolve a SID to a name (the LSA/SAMR LookupSids call), an attacker can just increment the RID and ask “who is this?” for every value in a range.
• Impact: Full domain username enumeration even when the more direct enumeration paths (SAMR EnumDomainUsers, LDAP anonymous bind) are locked down — LookupSids is frequently still allowed over a null/Guest session even when the enumeration calls aren’t.

How it works

LookupSids exists so that, given a SID, a caller can resolve it to a human-readable account name (this is what lets Windows show “DOMAIN\username” instead of a raw SID in file ownership, event logs, etc.). Restricting this call is far less common than restricting the more obviously sensitive EnumDomainUsers/EnumDomainGroups calls, since on its face it just looks like a name-resolution lookup rather than a listing operation. Cycling through RIDs 500, 501, 502, 1000, 1001, 1002… and resolving each one to a name (or getting “no such SID”) reconstructs the same user/group list an authenticated enumeration would have given directly.

Exploitation

Prerequisites

• A null/Guest SMB session, or any valid low-privilege credential

Attack Vectors

impacket-lookupsid '<domain>/.'@<target> -no-pass

Then filter down to just user accounts (as opposed to groups/computers):

impacket-lookupsid '<domain>/.'@<target> -no-pass | grep SidTypeUser

Notes

• Worth trying whenever direct --users/rpcclient enumdomusers-style enumeration gets refused on a null/Guest session — the two calls are gated independently, and it’s common for one to be locked down while the other isn’t.
• Once any valid credential is obtained, re-running normal enumeration (nxc smb ... --users) as that authenticated account can surface additional fields (group memberships, the description attribute — see Active Directory - Credentials in Description Field) that a null/Guest session never shows at all.

Mitigation

• Fix: Restrict anonymous access to SAMR (RestrictAnonymousSAM/RestrictAnonymous registry settings, or the “Network access: Restrict clients allowed to make remote calls to SAM” GPO) so unauthenticated LookupSids calls are refused the same way enumeration calls are.

Related Usage

File	Created
HTB - Cicada	Tuesday, July 21st 2026, 2:55:20 am

---

References:

• RID Cycling - HackTricks