User activity
SAM hive and user accounts
SAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
- Location
- C:\Windows\System32\config\SAM
- Proves
- Which local accounts exist, when they logged on and changed passwords, and group membership
- Timestamps
- Last logon, password last set and last failed logon as FILETIME, UTC in the F value; Users and Names key LastWrite, UTC
- Retention
- Persists until the account is deleted; remnants in hive slack, VSS copies of SAM, ProfileList and the profile folder
- Access
- SAM hive locked live: collect via raw NTFS (KAPE) or VSS, or reg save HKLM\SAM as administrator
- Evidence of
- User activity
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesSystem
- Velociraptor
- Windows.Triage.Targets:RegistryHivesSystem
Tools
Compare all tools- Registry ParserIn browser
- SecretsDumpIn browser
- Registry ExplorerGUI
- RegRipperCLI · open source
- VelociraptorPlatform · open source
- impacketCLI · open source
- SecretsDump: For authorized incident response only.
What it is
The Security Account Manager (SAM) hive holds the local user accounts and local groups of a Windows machine: names, relative identifiers (RIDs), account flags, logon statistics and the (encrypted) password hashes. Combined with the ProfileList key of the SOFTWARE hive, it lets you translate every SID found in other artifacts into an account, and spot accounts an attacker created or abused. Domain accounts are not stored in the SAM of member machines.
Location
| Artifact | Location |
|---|---|
| SAM hive | C:\Windows\System32\config\SAM (+ .LOG1 / .LOG2) |
| Local users | SAM\Domains\Account\Users\<RID in hex> (values F and V) |
| Name → RID | SAM\Domains\Account\Users\Names\<user name> (the value type holds the RID) |
| Local groups | SAM\Domains\Builtin\Aliases\<RID> (for example 00000220 = Administrators) |
| Profiles (SID → folder) | SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID> (ProfileImagePath) |
| Cached domain logons | SECURITY\Cache (NL$1, NL$2…) |
What it proves
- Which local accounts exist, their RIDs (500 = built-in Administrator, 501 = Guest, 1000+ = accounts created later) and whether they are disabled.
- When each account last logged on, last changed its password and last failed a logon, plus logon and failed-logon counters.
- Group membership, for example a new account added to Administrators or Remote Desktop Users.
- On Windows 8 and later, a Microsoft account linked to a local account (
InternetUserNameand name values under the user's key). ProfileListshows every account (local or domain) that has logged on interactively and created a profile.
Key fields
| Field | Where | Meaning |
|---|---|---|
| Last logon time | F value | Last successful interactive logon recorded locally |
| Password last set | F value | Last password change |
| Last failed logon | F value | Last incorrect password |
| Account expires | F value | Expiry, if set |
| Account control flags | F value | Disabled, password never expires, password not required… |
| Logon count / failed count | F value | Counters |
| User name, full name, comment, hashes | V value | Hashes are encrypted with keys derived from the SYSTEM hive boot key |
ProfileImagePath | ProfileList | Profile folder of the SID |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Last logon, password last set, last failed logon | Corresponding event on this machine | FILETIME, UTC | Local accounts only; network logons may not update it |
Users\<RID> key LastWrite | Any change to the account's values | FILETIME, UTC | Often close to the last logon or password change |
Names\<user> key LastWrite | Name key created or renamed | FILETIME, UTC | Usually the account creation time |
Retention and clearing
- Deleting an account removes its keys; traces may remain in hive slack, shadow-copy SAM hives, the
ProfileListkey and the profile folder underC:\Users. - Events 4720 (created), 4722 (enabled), 4724 (password reset attempt), 4725 (disabled), 4726 (deleted), 4732 (added to a local group) and 4738 (changed) in the Security log give the history the SAM cannot.
Collection
- KAPE target:
RegistryHivesSystem(SAM, SECURITY, SYSTEM, SOFTWARE with logs) - Velociraptor (
Windows.Triage.Targets):RegistryHivesSystem;Windows.Forensics.SAMparses accounts live. - Built-in (administrator):
reg save HKLM\SAM E:\case\SAM.hiv
reg save HKLM\SYSTEM E:\case\SYSTEM.hiv
net user
net localgroup administrators
Parsing tools
- Registry Explorer (Eric Zimmerman): SAM plugin that decodes
FandV. - RegRipper:
samparseplugin,profilelistplugin for the SOFTWARE hive. - Velociraptor:
Windows.Forensics.SAM,Windows.Sys.Users. - Impacket
secretsdump.py(offline, with SAM + SYSTEM [+ SECURITY]): for authorized incident response only, for example to check whether a compromised local administrator hash is reused across hosts.
Investigation tips
- List RIDs above 1000 created during the incident window (
Nameskey LastWrite, event 4720) and check their group membership. - A disabled built-in Administrator (RID 500) suddenly enabled, or a password reset on it, is a common persistence move.
- Map SIDs from BAM/DAM, SRUM and event logs to names through
ProfileListand the SAM. - An account that logged on via RDP but has no profile folder may have been deleted afterwards: check shadow copies.
- Handle hash extraction as sensitive evidence: restrict it to authorized responders and document why it was needed.
Related artifacts
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
- NTDS.dit and domain controllersNTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
Glossary terms
- Security Identifier (SID)The unique value Windows uses to identify users, groups and computers, such as S-1-5-21-…-1001, found throughout registry, logs and file paths.
- Registry HiveAn on-disk file that backs part of the Windows Registry, such as `SYSTEM`, `SOFTWARE`, or `NTUSER.DAT`.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
- FILETIMEThe 64-bit Windows timestamp format counting 100-nanosecond intervals since 1 January 1601 UTC, used by NTFS, the registry and many artifacts.
Guides
- Getting Started with Windows ForensicsStart Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.
- Credential Access Forensics: LSASS, DCSync and KerberoastingInvestigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.