With IPHost Network Monitor you can run WMI SID monitoring of various devices in your network.
To create a WMI monitor for SID, provide host name (it must be a Windows host) and specify custom WQL query:
The SID property contains the security identifier (SID) for this account. a SID is a string value of variable length used to identify a trustee. Each account has a unique SID issued by an authority (such as a Windows domain), stored in a security database. When a user logs on, the system retrieves the user's SID from the database and places it in the user's access token. The system uses the SID in the user's access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot be used again to identify another user or group.
The Win32_SystemAccount class represents a system account. The system account is used by the operating system and by services that run under Windows NT. There are many services and processes within NT that need the capability to logon internally (for example during a Windows NT installation). The system account was designed for that purpose; it is an internal account, does not show up in User Manager, cannot be added to any groups, and cannot have user rights assigned to it. On the other hand, the system account does show up on an NTFS volume in File Manager in the Permissions portion of the Security menu. By default, the system account is granted full control to all files on an NTFS volume. Here the system account has the same functional privileges as the administrator account.
IPHost Network Monitor is an advanced and easy tool for monitoring LAN and WAN networks, network servers, workstations and TCP/IP devices. Use IPHost Network Monitor to monitor your servers, domains, computers and devices.
