function GetAccountSid(const Server, User: WideString; var Sid: PSID): DWORD;
var
  dwDomainSize, dwSidSize: DWord;
  R : LongBool;
  wDomain : WideString;
  Use : DWord;
begin
  Result := 0;
  SetLastError(0);
  dwSidSize := 0;
  dwDomainSize := 0;
  R := LookupAccountNameW(PWideChar(Server), PWideChar(User), nil, dwSidSize, nil, dwDomainSize, Use);
  if (not R) and (GetLastError = ERROR_INSUFFICIENT_BUFFER) then
  begin
    SetLength(wDomain, dwDomainSize);
    Sid := GetMemory(dwSidSize);
    R := LookupAccountNameW(PWideChar(Server), PWideChar(User), Sid, dwSidSize, PWideChar(wDomain), dwDomainSize, Use);
    if not R then
    begin
      FreeMemory(Sid);
      Sid := nil;
    end;
  end
  else
    Result := GetLastError;
end;

function ConvertSidToStringSidW(Sid: PSID; var StringSid: String): Bool; stdcall;

implementation

function ConvertSidToStringSidW; external advapi32 name 'ConvertSidToStringSidW';

procedure TForm1.Button3Click(Sender: TObject);
var
  SID: PSID;
  strSID: String;
begin
  SID := nil;
  GetAccountSid('hal9000', 'Michael', SID);
  ConvertSidToStringSidW(SID, strSID);
  ShowMessage(strSID);
end;