Sysinternals Eula
A subkey for each Sysinternals tool this account has run, such as PsExec or ProcDump.
Use it to show a Sysinternals tool such as PsExec or ProcDump ran under an account, and roughly when it first did.
- NTUSER.DAT
- Program Execution
What It Is
The first time a Sysinternals tool runs under an account, it asks the user to accept its licence, and the tool records that acceptance in a subkey named for itself. That acceptance marks that a tool such as PsExec or ProcDump ran under this account, and roughly when it first did. It shows the tool ran at least once, not how often or what it did. It lives in the user's own NTUSER.DAT.
What It Proves
Someone using this account ran that tool and accepted its licence. For tools that save no other settings there, such as PsExec, the subkey last write time is usually the first run.
What It Does Not Prove
It shows the tool ran at least once, not how often or what it did, and an admin script can set the value with no run at all. Look-alikes such as Impacket psexec write nothing, and some attackers delete the key afterwards.
Where It Lives
Sysinternals EulaAccepted lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The PsExec licence was accepted under alice's account, so PsExec most likely ran as her. A script can set this with no run at all, so confirm it in Prefetch or BAM. |
| PsExec likely first ran under alice's account at about 12 Oct 2026 09:58 UTC. Look for PSEXESVC installs, System event 7045, on the hosts it reached. |
| ProcDump likely first ran under alice's account at about 15 Oct 2026 16:50 UTC, during the USB session. Check EDR for a dump of LSASS at that time. |
| SDelete, a secure delete tool, likely first ran about 15 Oct 2026 17:01 UTC, four minutes before the stick left. The USN journal can name the files it wiped. |
How to Read It
Each subkey under Sysinternals names a tool, such as PsExec, ProcDump or SDelete, and holds EulaAccepted set to 1. The subkey's last write time is usually the first run, though GUI tools such as Process Explorer also save settings there, which moves it. Check the DEFAULT hive and service profiles too, because a tool run as SYSTEM writes there, not to a user hive.
- When Windows Writes It
- When a Sysinternals tool first runs under an account, or runs with -accepteula.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
The acceptance mark is not an event of its own, so parse the hive, or read it live with Velociraptor. Process creation records and Prefetch show the tool actually running.
Catches renamed copies too, through the version info. It does not read the key.
// Sysinternals tools started on the device, by -accepteula or by version infoDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Sysinternals EulaAccepted shows.
- AmcacheGives the path and SHA-1 of the tool on disk, to identify the exact copy.
- Prefetch for PSEXEC.EXE and PROCDUMP64.EXENot in the RegistryConfirms the tool really ran, and when, since a script can set this key with no run.
- PSEXESVC Service Installs on the Target, System Event 7045Not in the RegistryShows which hosts PsExec reached, and when, from the targets' own logs.
Sources
The facts on this page come from these public pages, which say more on each point.