DFIRHub

Windows registry artifactLogonStats

First Time a User Logs in to a System.

  • User Activity
  • 2 keys
  • NTUSER

Registry keys

2 keys that RECmd reads for this artifact

  • NTUSERFirstLogonTime
    software\Microsoft\Windows\CurrentVersion\Explorer\LogonStats

    First Time a User Logs in to a System.

  • NTUSERFirstLogonTimeOnCurrentInstallation
    software\Microsoft\Windows\CurrentVersion\Explorer\LogonStats

    First Time a User Logs in to a System with Current Installation.

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)