Profile
Every account with a profile on the machine, local or domain, mapped from SID to folder.
Use it to map SIDs to user names and profile folders, and see which accounts have used this machine.
- SOFTWARE
- Accounts and RDP
What It Is
ProfileList is where Windows records every account that has a profile folder on the machine, both local and domain, with the folder path for each. Each account is a subkey named by its security identifier (SID), the number Windows uses for an account, and the ProfileImagePath value gives the folder, which also gives the user name. It is the key that turns a SID into a name, which you need to read the many artefacts filed by SID. It lives in SOFTWARE.
What It Proves
An account with that SID had its profile loaded here, usually by an interactive or RDP logon, and its folder is ProfileImagePath.
What It Does Not Prove
No logon counts, and accounts whose profile never loaded have no entry. A service or program running as the account can load a profile too, with nobody at the keyboard.
Where It Lives
ProfileList lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The SID ending 1001 is the local account alice, with her profile in C:\ |
| The new support account has a profile here, so something loaded it, usually a logon. Check event 4624 in the Security log for how and when it signed in. |
| The domain service account svc-backup has a profile on this workstation. A service can load a profile with nobody at the keyboard, so check whether a person used it. |
How to Read It
Each subkey is a SID, and its ProfileImagePath value gives the folder and so the user name. Domain SIDs share the domain's prefix, while local ones share the machine's prefix, with RIDs from 1000. On Windows 10 and 11, LocalProfileLoadTimeHigh and LocalProfileLoadTimeLow together give the last time the profile loaded.
- When Windows Writes It
- When a profile is created at first interactive logon, and as profiles load and unload.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (profilelist)
Hunt It
Which accounts have a profile on the machine sits in this key and is not an event of its own, so parse SOFTWARE, or read it live with Velociraptor. A profile loads at an interactive or Remote Desktop logon, which the Security log records in event 4624.
Matches SIDs to names and logon times. A profile created before your retention window only shows in the hive.
// Interactive logons with SIDs, to match against ProfileListDeviceLogonEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what ProfileList shows.
- SAM User AccountsGives a local account's logon count, last logon and password change times.
- Logons, Security Event 4624Not in the RegistryGives the logon type, which tells a person at the keyboard from a service.
- Profile Folders Under C:\UsersNot in the RegistryDates each profile by its folder's creation time, usually the first logon.
Sources
The facts on this page come from these public pages, which say more on each point.