Getting localized name of "NT AUTHORITY\System"

Hello

We have customers with different locale settings.

We need to use "NT AUTHORITY\System" user for a service
but it is localized for different locales.
I searhed about it and found that its SID is

S-1-5-18.

and tried using its sid to get localized name, but couldnt succeed it.

What I tried is (code by kichik)

System::Call "*(&i1 0, &i4 0, &i1 5) i.r0"
# System::Call "advapi32::AllocateAndInitializeSid(i r0, i 2, i 32 , i 544, i 0, i 0, i 0, i 0, i 0, i 0, *i .r1)"
; commented one works
System::Call "advapi32::AllocateAndInitializeSid(i r0, i 2, i 18 , i 0, i 0, i 0, i 0, i 0, i 0, i 0, *i .r1)"
System::Free $0
System::Call advapi32::ConvertSidToStringSid(ir1,*t.R0)
DetailPrint "sid $R0"
StrCpy $R0 ${NSIS_MAX_STRLEN}
System::Call "advapi32::LookupAccountSid(i 0, i r1, t .r0, *i R0, t .r2, *i R0, *i .r3)"
System::Call "advapi32::FreeSid(i r1)"
DetailPrint " Result $0"

I tried it for different acounts, it works
currently it doesnt work for special groups that mentioned below


I think problem is having 3 numeric part, it works with 4 digit part sids like S-1-5-32-544

also I got usefull information from thread


thanks for help
Selim

Whe you change the SID value from S-1-5-32-544 to S-1-5-18 you also have to change the second parameter of AllocateAndInitializeSid from 2 to 1:

System::Call "advapi32::AllocateAndInitializeSid(i r0, i 1, i 18 , i 0, i 0, i 0, i 0, i 0, i 0, i 0, *i .r1)"

Don

Yess it works 🙂
I appreciate your help. Thank you very much.

But to my surprise,It just returns SYSTEM as the user name.

But I need indeed first part.

"NT Authority\System" because that was the first part
changes by locales (French, German etc.)

You have any idea?
I think I need to query "System" users group.

Selim

I got the "NT AUTHORITY" part with same code.
it is loaded into register 2
just add to the end of code on first post.

DetailPrint " Result $2"

This gets localised name for "nt authority"

Selim