One
OneDrive accounts this user signed in to, with the email, sync folder and account ID.
Use it to spot a personal OneDrive account syncing on a work machine, with its email, sync folder and last sign-in.
- NTUSER.DAT
- Office, Email and Cloud Apps
What It Is
OneDrive records the accounts a user has signed in to, with the email address, the folder each syncs to and the account ID. A personal OneDrive account syncing on a work machine shows up here, and that is a common way data leaves the company. Personal is a consumer Microsoft account, while Business1 and later are work or school accounts. It shows the set-up, not which files synced. It lives in the user's own NTUSER.DAT.
What It Proves
This user signed OneDrive in to that account and synced it to that folder. Personal is a consumer Microsoft account, and Business1 and later are work or school accounts.
What It Does Not Prove
It shows the account set-up, not which files synced, which is in the OneDrive settings and sync database files. A personal account on a work laptop is a lead, not proof that data left.
Where It Lives
OneDrive Accounts lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Business1 is alice's work account, alice@corp |
| A personal Microsoft account also syncs C:\ |
| The personal account's ID is 3f9a2c71b4e8d605. It names the settings and sync database to parse for the files it synced. |
| The personal account last signed in 13 Oct 2026 19:58 UTC. Check what was copied into its folder from then on. |
How to Read It
Personal holds a consumer Microsoft account, while Business1, Business2 and so on hold work or school accounts. Read UserEmail, UserFolder (the sync folder) and cid or UserCid, the account ID that names the settings files. LastSignInTime is Unix seconds in UTC, and Tenants lists shared libraries synced to other folders. SyncEngines\Providers\OneDrive, also in NTUSER.DAT, lists every synced folder with its mount point and URL.
- When Windows Writes It
- When the user signs OneDrive in or out, and as its settings change.
- Which Windows Versions
- Windows 7 to 11 with the OneDrive sync app
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
The account set-up sits in this per-user key, so parse the hive, or read it live with Velociraptor. Files staged in a sync folder show in EDR file data, and the Microsoft 365 audit log records uploads to work accounts.
Reads the DeviceFileEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, which catches files staged in a OneDrive folder, personal or work, for the file types Defender monitors. It does not read the accounts key or show an upload, so match the folder to UserFolder.
// Files written into OneDrive sync folders, ready to uploadDeviceFileEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what OneDrive Accounts shows.
- OneDrive Settings and Logs in AppData\Local\Microsoft\OneDriveNot in the RegistryLists the files that synced, which this key does not.
- OneDrive Uploads in the Microsoft 365 Audit LogNot in the RegistryRecords uploads to work accounts, never personal ones, with file names and times.
Sources
The facts on this page come from these public pages, which say more on each point.