whoami - displays logged on user information
whoami
- C:\Windows\system32\whoami.exe /?
Output:
WhoAmI has three ways of working:
Syntax 1:
WHOAMI [/UPN | /FQDN | /LOGONID]
Syntax 2:
WHOAMI { [/USER] [/GROUPS] [/CLAIMS] [/PRIV] } [/FO format] [/NH]
Syntax 3:
WHOAMI /ALL [/FO format] [/NH]
Description:
This utility can be used to get user name and group information
along with the respective security identifiers (SID), claims,
privileges, logon identifier (logon ID) for the current user
on the local system. I.e. who is the current logged on user?
If no switch is specified, tool displays the user name in NTLM
format (domain\username).
Parameter List:
/UPN Displays the user name in User Principal
Name (UPN) format.
/FQDN Displays the user name in Fully Qualified
Distinguished Name (FQDN) format.
/USER Displays information on the current user
along with the security identifier (SID).
/GROUPS Displays group membership for current user,
type of account, security identifiers (SID)
and attributes.
/CLAIMS Displays claims for current user,
including claim name, flags, type and values.
/PRIV Displays security privileges of the current
user.
/LOGONID Displays the logon ID of the current user.
/ALL Displays the current user name, groups
belonged to along with the security
identifiers (SID), claims and privileges for
the current user access token.
/FO format Specifies the output format to be displayed.
Valid values are TABLE, LIST, CSV.
Column headings are not displayed with CSV
format. Default format is TABLE.
/NH Specifies that the column header should not
be displayed in the output. This is
valid only for TABLE and CSV formats.
/? Displays this help message.
Examples:
WHOAMI
WHOAMI /UPN
WHOAMI /FQDN
WHOAMI /LOGONID
WHOAMI /USER
WHOAMI /USER /FO LIST
WHOAMI /USER /FO CSV
WHOAMI /GROUPS
WHOAMI /GROUPS /FO CSV /NH
WHOAMI /CLAIMS
WHOAMI /CLAIMS /FO LIST
WHOAMI /PRIV
WHOAMI /PRIV /FO TABLE
WHOAMI /USER /GROUPS
WHOAMI /USER /GROUPS /CLAIMS /PRIV
WHOAMI /ALL
WHOAMI /ALL /FO LIST
WHOAMI /ALL /FO CSV /NH
WHOAMI /?
Return Code: 0
C:\Windows\system32\whoami.exe
c:\>ver
Microsoft Windows [Version 10.0.19045.2075]
| File | Info |
|---|---|
| File Size | 73728bytes |
| Creation Time | 2019/12/07 18:09:30 |
| LastWrite Time | 2019/12/07 18:09:30 |
| ProductVersion | 10.0.19041.1 |
| FileVersion | 10.0.19041.1 (WinBuild.160101.0800) |
| Hash | Value |
|---|---|
| MD5 | a4a6924f3eaf97981323703d38fd99c4 |
| SHA1 | 1915fbfdb73fdd200c47880247acdde5442431a9 |
| SHA224 | 920b7460f30bd517be5449d92cd45441b0adf75c53bb2d3d8eeb84f5 |
| SHA256 | 1d4902a04d99e8ccbfe7085e63155955fee397449d386453f6c452ae407b8743 |
| SHA384 | 3b13c11d92f1081bbabc199f32bbaa506b0c6917c4fba93841dc32cdcfb8b48dea2142cd6f5d7964eeef2fab25a5c4b9 |
| SHA512 | 90a556b98c1fddbc862e851c560bf57b2166572c1425ad624c7ade54073012f0cf84fd1e6047015ff2ceea96806ac8af2bba59b1f86f80adf9c46a95cfd22262 |