Microsoft recently updated a KB that lists the well-known security Identifiers (SIDs). The revised KB can be found here.

I’ve said many times that a default installation of Active Directory is not secure. There are several reasons for this, and I do not consider this to be a design flaw. However, there are several built-in features that enable you to secure AD according to your specific requirements.

One of the most common “mitigation” you read is to rename built-in accounts, such as the Administrator account. I’ve never been a fan of this recommendation simply because anyone really looking to exploit your AD environment will be able to determine the renamed account in a matter of seconds. This has to do with well-known SIDs.

Microsoft defines well-known SIDs as:

A group of SIDs that identify generic users or generic groups. Their values remain constant across all operating systems.

And, the built-in Administrator account is a well-known SID. Therefore, anyone can find the renamed Administrator account simply by knowing the SID. Again, since this is a built-in account, the SID is going to be the same regardless of the environment. All you need to find out is the domain SID, which isn’t difficult. (The Administrator account has a SID of S-1-5-21domain-501, where domain is the domain’s SID).

IMO, renaming built-in accounts may ward off the novice hacker, but it won’t save you from the ones looking to cause real damage. Nonetheless, you should always look at the risks that apply to your environment, and mitigate them accordingly.