Last Login

Description: List the last login time for a specific local user.

Location:

• C:\Windows\System32\Config\SAM
  • SAM\Domains\Accounts\Users

Notes: Only the last login time will be stored in the registry key.

Analysis: Using Registry Explorer by Eric Zimmerman, we can load the SAM registry hive and analyze the SAM\Domains\Accounts\Users key.



A Registry Explorer plug-in does the heavy lifting, allowing us to reference this key to collect information useful for user profiling. The Last Login Time column displays the last login timestamp. The timestamp is displayed in UTC.