whoami

whoami prints the current effective user. It exists on Windows (since the NT resource kit era, built-in from Vista/Server 2008) and on Linux/macOS/AIX — on the latter it’s a GNU coreutils tool returning just the username, while the Windows build is a full identity-reporting tool:

whoami                 # domain\user
whoami /upn            # user principal name (user@domain)
whoami /fqdn           # fully qualified DN
whoami /all            # everything below, plus SID, logon info
whoami /user           # user + SID
whoami /groups         # group memberships (incl. mandatory integrity level)
whoami /priv           # privileges and their state (enabled/disabled)

The flags support /fo list|table|csv output formats and /nh (no header) for scripting.

Why operators run it first

whoami is the canonical “where am I, what can I do” command after gaining execution (MITRE T1033 — System Owner/User Discovery):

• whoami /groups reveals local/domain group membership and the mandatory integrity level (Medium/High/System) — the quickest way to know whether you’re in an elevated token.
• whoami /priv enumerates privilege tokens. High-value hits:
  • SeImpersonatePrivilege → potato-family privesc (PrintSpoofer, GodPotato, JuicyPotato) to SYSTEM — commonly held by service accounts like IIS APPPOOL or NT SERVICE.
  • SeDebugPrivilege → open and read arbitrary processes (LSASS dumping).
  • SeBackupPrivilege / SeRestorePrivilege → read/write any file regardless of ACLs (SAM/SYSTEM hive theft).
  • SeTakeOwnershipPrivilege → take ownership of any securable object.
• Output is quiet and built-in — no uploads, no signatures, works under application whitelisting.

On Linux, whoami tells you almost nothing; the equivalent identity sweep is id (uid/gid/groups). See suid-shell-executable for the *NIX-side privilege angle.

Related

• windows-reconnaissance-commands — whoami sits in the users/groups/privileges table
• icacls — what to reach for after discovering SeRestore/SeTakeOwnership
• windows-ntfs-permissions — the DACL model those privileges bypass

Sources

• Microsoft Learn — whoami
• MITRE ATT&CK T1033 — System Owner/User Discovery
• man7 — whoami(1)