SAM User Accounts
Local accounts with RID, creation time, last logon, logon count and password change.
Use it to list local accounts with their creation, last logon and password change times, and spot new ones.
- SAM
- Accounts and RDP
What It Is
The SAM, the Security Account Manager, is where Windows keeps the local accounts on a machine, the ones that are not in the domain. For each account it records a RID, the number that identifies it, with the creation time, the last logon, the logon count and when the password was last changed. An investigator reads it to list the local accounts and spot a new one an attacker added. It is the SAM hive, readable only as SYSTEM on a running machine.
What It Proves
The local account existed, with the logon and password times Windows last recorded. Internet values mark a linked Microsoft account.
What It Does Not Prove
It holds local accounts only, because domain accounts live on the domain controller. Microsoft accounts keep no logon counts, and a major update can reset the creation time.
Where It Lives
SAM User Accounts lives in the SAM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SAM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice (RID 1001) last logged on at 15 Oct 2026 08:02 UTC, with 214 logons recorded. Match the last one to event 4624 in the Security log for its logon type and source. |
| A local account named support was created at 12 Oct 2026 09:55 UTC, three minutes before PsExec ran. The SAM does not say who made it, but event 4720 in the Security log does. |
| support (RID 1002) has logged on once, at 12 Oct 2026 10:03 UTC. A brand new account already in use is worth running down, so find where that logon came from in event 4624 in the Security log. |
How to Read It
Each subkey under Users is a RID in hexadecimal, so 000001F4 is 500 (the Administrator) and 000003E9 is 1001. The F value holds the last logon, password set and failed logon times with the logon count, and the V value holds the name. The last write time of Users\Names\<name> marks when the account was created. A tool such as RegRipper decodes F and V, because the raw values are packed binary.
- When Windows Writes It
- At account creation, and at each logon, failed logon and password change.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RegRipper (samparse), RECmd
Hunt It
A new local account and its logon times sit only in the SAM hive, so parse it offline or read it live with Velociraptor. The Security log records the account being created in event 4720 and each sign-in in event 4624.
Gives last logon and a count per account from Defender data. It does not read SAM, so creation and password times stay in the hive.
// Last logon and logon count per account on the deviceDeviceLogonEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what SAM User Accounts shows.
- ProfileListShows the account's profile loaded on this machine, and covers the domain accounts SAM lacks.
- Account Created, Security Event 4720Not in the RegistryNames who created the account, and when, which SAM does not record.
- Logons, Security Event 4624Not in the RegistryShows each logon with its type and source, where SAM keeps a count and the last time.
Sources
The facts on this page come from these public pages, which say more on each point.