2

Which system file stores the information displayed by the "net user Administrator" command in Windows 7? Need to find the details of the users in a dead Windows 7 machine.

Details of the command is here.

Edit:

I have been informed by @Moab that specific user info is stored in each user account folder in the NTUSER.DAT file. However, in my case, the administrator account has never been logged on and it does not have a user account folder.

Improve this question
4
  • I assume it is stored in the same place as user passwords, the Windows registry.
    – Moab
    Commented Mar 31, 2019 at 22:48
  • @Moab what is that location?
    – Gradient
    Commented Mar 31, 2019 at 22:53
  • See this....thewindowsclub.com/…
    – Moab
    Commented Mar 31, 2019 at 22:57
  • There is also specific user info stored in each users account folder in the NTUSER.DAT file. C:\Users\<User name>\ntuser.dat
    – Moab
    Commented Mar 31, 2019 at 22:59

1 Answer 1

Reset to default
0

If You were within Active Directory environment, I would say to start with analyzing ntds.dit. But since You are in probably desktop machine, I suggest to look around SAM/SYSTEM/SOFTWARE registry files, which might store informations like the one You need (like user creation date)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .