Logged in Accounts

Accounts Present on System:

Find all Local accounts on a system (Cloud accounts could be present too, if they have email):

• HKLM\SAM\Domains\Account\Users\

Interactively Logged in Accounts:

Find domain accounts that interactively logged in (have a profile on system and provided GUI desktop). LOCAL AND DOMAIN:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList