Finding the user or group SID for use in RepCLI Authentication

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How do I find the user or group SID for use in RepCLI Authentication?

Environment

• Microsoft Windows: All Supported Versions

Resolution

• Command Prompt

Run one of the the following commands

whoami /user

or

whoami /groups

• Powershell

Run command

Get-ADGroup [Group Name]

NOTE: Replace [Group Name] with actual name of group. e.g. Get-ADGroup Domain Users

• Microsoft Security identifiers Page
  • Well-Known-Sid's

Additional Information

Recommendation would be to create a domain CBC-Admins security group for only the CBC admins to have access to limit access to CBC commands.