DFIRHub

Windows registry artifactMicrosoft Office

Lists email addresses registered to Microsoft Office on the user's system

  • Microsoft Office
  • 8 keys
  • NTUSER

Registry keys

8 keys that RECmd reads for this artifact

  • NTUSEREmailAddresses
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists email addresses registered to Microsoft Office on the user's system

  • NTUSEREmailAddress
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists email address registered to Microsoft Office on the user's system

  • NTUSERFirstName
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists first name for the registered Microsoft Office user

  • NTUSERLastName
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists last name for the registered Microsoft Office user

  • NTUSERFriendlyName
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists full name for the registered Microsoft Office user

  • NTUSERInitials
    Software\Microsoft\Office\*\Common\Identity\Identities\*

    Lists initials for the registered Microsoft Office user

  • NTUSERrecursive
    Software\Microsoft\Office\*\Common\Identity\Identities\*\AuthHistory

    Displays time user was authenticated to the system's instance of Microsoft 365 for the first time

  • NTUSERrecursive
    Software\Microsoft\Office\*\Common\Identity\Profiles\*

    Displays time user was authenticated to the system's instance of Microsoft 365 for the first time

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)