Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ghostpack/rubeus/llms.txt

Use this file to discover all available pages before exploring further.

The currentluid command reads the LUID of the logon session that owns the calling process token. A LUID (Locally Unique Identifier) is a 64-bit value the Windows LSA assigns to every logon session at creation time; it uniquely identifies a session for the lifetime of the system boot. Knowing your current LUID is useful when you want to pass it to another Rubeus command’s /luid parameter to explicitly target your own session, or when you need to record it before spawning a new session with createnetonly.

Usage

The command takes no flags.
Rubeus.exe currentluid
Example output:
[*] Action: Display current LUID

[*] Current LogonID (LUID) : 0x4571a2 (4550050)
The LUID is printed in both hexadecimal (0x4571a2) and decimal (4550050) form. Either representation is accepted by Rubeus commands that take a /luid parameter, such as ptt, purge, dump, triage, klist, and tgssub.
LUIDs are volatile — they reset on every reboot and change each time a user logs on. Always query currentluid fresh rather than reusing a value recorded in a previous session.

Build docs developers (and LLMs) love