The Security Identifier (SID) S-1-5-21-1223352397-1872883824-861252104-501 ends with the Relative Identifier (RID) 501. According to Microsoft's official documentation, the RID 501 corresponds to the built-in Guest account, which has severely restricted privileges. To gain "full administrator access," which is typically associated with the Administrator account (RID 500) or membership in the Administrators group, Matthew must elevate his current low-level permissions. This process of transitioning from a low-privilege account to a high-privilege account is known as privilege escalation.

B. He needs to disable antivirus protection.

Disabling antivirus is a common post-exploitation step to maintain access and avoid detection, but it does not grant administrative privileges itself.

C. He needs to gain physical access.

Physical access is one vector for privilege escalation but is not a strict requirement. Many privilege escalation techniques can be performed remotely via software vulnerabilities.

D. He already has admin privileges, as shown by the “501” at the end of the SID.

This is factually incorrect. The RID for the built-in Administrator account is 500. The RID 501 identifies the built-in Guest account.

---

1. Microsoft Corporation. (2023). Well-known SIDs. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/well-known-security-identifiers-in-windows-operating-systems.

Reference Specifics: In the section "Well-known RIDs

" the document explicitly lists DOMAINUSERRIDGUEST with a relative ID of 501 ("A user account for guests of the domain") and DOMAINUSERRIDADMIN with a relative ID of 500 ("The administrative user account in a domain"). This directly confirms that the SID in the question belongs to a Guest account

not an Administrator.

2. MITRE. (2023). ATT&CK Tactic TA0004: Privilege Escalation. The MITRE Corporation. Retrieved from https://attack.mitre.org/tactics/TA0004/.

Reference Specifics: The MITRE ATT&CK framework

a globally recognized knowledge base of adversary tactics

defines Privilege Escalation as "the result of actions that allow an adversary to obtain a higher level of permissions on a system or network." This definition directly applies to Matthew's situation

where he must move from a low-privilege Guest account to an administrative one.

3. Pfleeger

C. P.

& Pfleeger

S. L. (2003). Security in Computing (3rd ed.). Prentice Hall.

Reference Specifics: Chapter 4

"Programs and Programming

" section on "Gaining Privileges

" discusses how malicious code often seeks to "obtain privileges to which it is not entitled." The text explains that a program running with the privileges of a normal user (or in this case

a guest) must exploit a system flaw to gain the privileges of a more powerful user

such as an administrator. This academic text establishes the fundamental concept of privilege escalation.