# Logged in Accounts

### Accounts Present on System:

Find all Local accounts on a system (Cloud accounts could be present too, if they have email):

* HKLM\SAM\Domains\Account\Users\\

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FWOSqWvjx8gaHEBRfMoEq%2Fimage.png?alt=media&#x26;token=d4c85625-fa97-481c-b2d5-acd0953092b6" alt=""><figcaption></figcaption></figure>

### Interactively Logged in Accounts:

Find domain accounts that interactively logged in (have a profile on system and provided GUI desktop). LOCAL AND DOMAIN:

* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FRBFGslQMz1NEaRy4XSrF%2Fimage.png?alt=media&#x26;token=7860345f-cba3-4448-a7db-bb02b7a9a9ba" alt=""><figcaption></figcaption></figure>
