DFIRHub

Windows registry artifactWinLogon

Displays the username of the last user logged in to this system

  • System Info
  • 5 keys
  • SOFTWARE

Registry keys

5 keys that RECmd reads for this artifact

  • SOFTWARELastUsedUsername
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Displays the username of the last user logged in to this system

  • SOFTWAREAutoLogonSID
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Displays the SID of the user who is set to auto login to Windows

  • SOFTWAREAutoAdminLogon
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Displays whether the system will automatically login a user as Admin, 0 = Disabled, 1 = Enabled

  • SOFTWAREDefaultUserName
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Displays the default username the system will log in as

  • SOFTWAREDefaultPassword
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Displays the password to be used for the account specified in DefaultUserName

References

3 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)