DFIRHub

Windows registry artifactSpecialAccounts

Hides Accounts from being visible on Logon Screen and Start Menu, 0 = Hide User Account, 1 = Show User Account, 65536 (0x10000) = Hide User Accounts Starting with e.g. J with this value would hide all accounts starting with J

  • User Accounts
  • 1 key
  • SOFTWARE

Registry keys

1 key that RECmd reads for this artifact

  • SOFTWARErecursive
    Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

    Hides Accounts from being visible on Logon Screen and Start Menu, 0 = Hide User Account, 1 = Show User Account, 65536 (0x10000) = Hide User Accounts Starting with e.g. J with this value would hide all accounts starting with J

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)