Windows registry artifactUser Accounts (SAM)
User accounts in SAM hive
- User Accounts
- 1 key
SAM
Registry keys
1 key that RECmd reads for this artifact
SAMSAM\Domains\Account\UsersUser accounts in SAM hive
References
2 links
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)