Logged in Accounts
Accounts Present on System:
Find all Local accounts on a system (Cloud accounts could be present too, if they have email):
HKLM\SAM\Domains\Account\Users\
Interactively Logged in Accounts:
Find domain accounts that interactively logged in (have a profile on system and provided GUI desktop). LOCAL AND DOMAIN:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Last updated