SAM User Names and RIDs

Every local account name, matched to its RID, with a key time marking its creation.

Use it to match each local account name to its RID, date when each name appeared, and spot a gap left by a deleted account.

SAM
Accounts and RDP

What It Is

Windows knows each local account by two things, the user name people see and the RID it uses itself, the number at the end of the account's SID. The RID never changes, even when the account is renamed. The Names key in the SAM hive holds one subkey per user name, and Users holds one subkey per RID with that account's details. Windows never gives the same RID twice, so the RIDs also show the order accounts were made in.

What It Proves

An account with that name exists, and its Names subkey's last write time usually marks when it was created. Its RID shows where it falls in the order accounts were made.

What It Does Not Prove

A Windows feature update can rewrite these keys, so every account older than the update shows the update time instead. The key holds no logon data, which sits in the F value under Users.

Where It Lives

SAM User Names and RIDs lives in the SAM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SAM\Domains\Account\Users\Names\<user name>

C:\Windows\System32\config\SAM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in SAM User Names and RIDs, each with what it tells you
Registry Value	What It Tells You
`Users\Names\alice` `SubkeyLast write 3 Sep 2026 02:16 UTC`	This is two minutes after the feature update to Windows 11 began, so it dates the upgrade, not alice's account. Her RID, 1001, puts her first after the built-in accounts, so she most likely dates from the Windows 10 install.
`Users\Names\support` `SubkeyLast write 12 Oct 2026 09:55 UTC`	This is the only name newer than the update, so support is the only local account made since. Event 4720 in the Security log names who created it.
`Users\000003EA` `SubkeyRID 1002, V names support`	support took RID 1002, the next number after alice's 1001. No RID is missing between them, so no account was made and deleted in between.

How to Read It

Each subkey under Names is one account name. Users holds one subkey per RID in hexadecimal, such as 000003EA for 1002, and its V value holds the name. The Velociraptor SAM artifacts pair each name with its RID, and the CreateTimes source lists each Names key's last write time. Sort the names by key time. A time newer than the latest feature update marks an account made since. Then read the RIDs in order. A missing number was used by an account or group that is no longer listed, and NextRID in the account policy shows any made after the last one.

When Windows Writes It: When a local account is created or deleted. A Windows feature update can rewrite the keys too.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Registry Explorer, RegRipper (samparse), RECmd

Hunt It

Account names and RIDs sit in the SAM hive, so parse it, or read it with Velociraptor. The Security log records each local account created, deleted or renamed in events 4720, 4726 and 4781, with User Account Management auditing on.

Sees Related ActivityDeviceLogonEvents

Local accounts carry the machine name as their domain. It shows only accounts that signed in, so one never used is in the SAM alone.

KQLDefender XDR, Advanced hunting

// Local accounts that signed in, each with the SID that ends in its RIDDeviceLogonEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where AccountDomain =~ "ws-042"| summarize FirstLogon = min(Timestamp), LastLogon = max(Timestamp) by AccountName, AccountSid| order by FirstLogon desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what SAM User Names and RIDs shows.

SAM User AccountsGives each RID's logon count, last logon and password change, which the Names key lacks.
SAM Account PolicyIts NextRID shows whether any account was made after the last one listed.
Account Created, Security Event 4720Not in the RegistryNames who created the account and when, even after a feature update rewrote the key times.

Sources

The facts on this page come from these public pages, which say more on each point.