System and accounts: OS version, time zone, users and SIDs

Before you interpret any user activity on a Windows computer, you need its basic facts: what the machine is called, which Windows version and build it runs, which time zone it was set to, and which accounts exist. These answers come from the SYSTEM, SOFTWARE and SAM hives and from the ProfileList key, and they frame every later finding. This lesson shows where each value lives on Windows 10 and 11, how it is encoded, and how to tie a security identifier (SID) to an account name and a profile folder.

Where the values live

In a triage collection the hives are files under C\Windows\System32\config\ (SYSTEM, SOFTWARE, SAM, SECURITY), each with its .LOG1 and .LOG2 transaction logs. Replay the logs before reading a dirty hive (Lesson 2.1). The paths below are relative to each hive's root.

CurrentControlSet does not exist in an offline SYSTEM hive: it is a link that Windows creates at boot. Read SYSTEM\Select, value Current (a REG_DWORD): if it is 1, the active set is ControlSet001, if 2, ControlSet002. This lesson writes ControlSet001; substitute the set that Current names.

Time zone: the first step of every examination

NTFS timestamps, registry LastWrite times and event log records are stored in UTC, but some artifacts record local time, for example network profile dates (below) and several plain-text logs. Tools also display times in whatever zone they are set to. Until you know the system's time zone, you cannot convert local values to UTC or check that a tool's output is really UTC. Establish it first and write it in your notes.

The TimeZoneInformation key holds:

• TimeZoneKeyName: the zone's identifier, such as E. South America Standard Time (Brasília) or W. Europe Standard Time.
• Bias: the standard offset in minutes, as a REG_DWORD.
• DaylightBias: the extra offset applied during daylight saving time, usually −60. StandardBias is usually 0.
• ActiveTimeBias: the offset in effect when the system last wrote the key, including any daylight adjustment.

The sign convention is the opposite of the familiar "UTC+1": UTC = local time + bias. A zone three hours behind UTC has a bias of 180; a zone one hour ahead has −60, which a REG_DWORD stores in two's complement as 0xFFFFFFC4. Central Europe in summer has an ActiveTimeBias of −120 (0xFFFFFF88). Some tools show the signed value, but Regedit and hex views show the raw 32-bit number, which you must interpret yourself.

ActiveTimeBias describes only one moment. In a zone that observes daylight saving, an event from the other season needs the other offset, so apply the zone's rules to each date rather than one bias to everything. Also remember that a user can change the time zone; the key's LastWrite time shows when it was last written.

Computer name and last shutdown

ComputerName is a REG_SZ value such as DESKTOP-7K2QF4M (an automatically generated name) or a name chosen by the user or organization. It identifies the host in event logs, network logs and other machines' artifacts.

ShutdownTime is an 8-byte REG_BINARY holding a FILETIME (100-nanosecond intervals since 1601-01-01 UTC). Windows writes it during an orderly shutdown; after a crash or power loss the value still shows the previous orderly shutdown. Compare it with event logs (Lesson 2.7) before relying on it.

Identifying the Windows version

SOFTWARE\Microsoft\Windows NT\CurrentVersion describes the installed operating system:

The full build is CurrentBuild.UBR, here 22631.4317.

The trap: on Windows 11, ProductName still reads "Windows 10 Pro", "Windows 10 Enterprise" and so on. Identify Windows 11 by CurrentBuild of 22000 or higher (22000 is 21H2, 22621 is 22H2, 22631 is 23H2, 26100 is 24H2, 26200 is 25H2). Windows 10 builds are below 22000; 22H2 is 19045.

InstallDate and InstallTime usually reflect the last feature update or in-place upgrade, not the original installation, because an upgrade reinstalls the OS and rewrites them. InstallDate 0x68B6EBA4 = 1,756,818,340 seconds = 2025-09-02T13:05:40Z may simply be the date of the last in-place upgrade. Windows keeps copies of the earlier values in SYSTEM\Setup subkeys named Source OS (Updated on <date>); check them before stating when Windows was first installed.

Network context in brief

SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{GUID} holds one subkey per network interface. For DHCP interfaces it records DhcpIPAddress, DhcpSubnetMask, DhcpServer, DhcpDefaultGateway and DhcpDomain, plus LeaseObtainedTime and LeaseTerminatesTime as REG_DWORD Unix epoch seconds (UTC). Static interfaces use IPAddress instead. These are the last recorded values, not a history.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} lists networks the computer has joined: ProfileName (often the Wi-Fi SSID), DateCreated (first connection) and DateLastConnected. The dates are 16-byte SYSTEMTIME structures, eight little-endian 16-bit fields (year, month, day of week with Sunday = 0, day, hour, minute, second, milliseconds), recorded in local time. They need the time zone to become UTC.

User accounts and SIDs

Windows identifies every account by a SID, not by its name. A local or domain account SID has the form S-1-5-21-<three sub-authorities>-<RID>:

• S: SID string prefix; 1: revision.
• 5: identifier authority, SECURITY_NT_AUTHORITY.
• 21: the first sub-authority, marking a machine or domain SID.
• Three 32-bit sub-authorities that identify the machine (for local accounts) or the domain (for domain accounts). They are generated at installation, so every local account on the same computer shares them.
• The relative identifier (RID), the last sub-authority, which identifies the account within that machine or domain.

In binary, a SID is a revision byte, a sub-authority count byte, a 6-byte big-endian authority and 4-byte little-endian sub-authorities: 1 + 1 + 6 + 5 × 4 = 28 bytes for a SID with five sub-authorities.

RIDs are allocated in increasing order and not reused, so a gap in the sequence can indicate a deleted account. Accounts joined to Microsoft Entra ID (formerly Azure AD) use SIDs beginning S-1-12-1-.

The SAM hive

SAM\Domains\Account\Users (inside the SAM file this sits under a top-level key also named SAM; live it is HKLM\SAM\SAM\Domains\Account\Users) has one subkey per local account, named by the RID as eight hex digits: RID 500 is 000001F4, RID 1001 is 000003E9. Each holds two binary values that tools such as RegRipper's samparse decode:

• F (fixed length): last logon, password last set, account expiry and last failed logon (all FILETIME), the RID, account control flags (for example, disabled), the failed-logon count and the logon count.
• V (variable length): user name, full name, comment, home directory and the encrypted password hashes.

The Names subkey has one subkey per user name, which gives a name-to-RID lookup. When a Microsoft account is linked, the RID key also holds values such as InternetUserName (the email address), GivenName and SurName. Last-logon values cover logons to that local account record; corroborate them with logon events (Lesson 2.7).

ProfileList: from SID to profile folder

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID> has one subkey per user profile on the computer, including S-1-5-18, -19 and -20. ProfileImagePath gives the folder, such as C:\Users\maria, and therefore the path to that user's NTUSER.DAT and UsrClass.dat.

Local, Microsoft and domain accounts

Domain accounts are stored on the domain controller, not in the local SAM. Their only local traces are ProfileList entries, profile folders, event logs and cached credentials: by default Windows caches the last 10 domain logons (CachedLogonsCount under SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon) in the SECURITY hive, so users can sign in without reaching the domain.

A profile folder name can differ from the current account name. Renaming an account changes the name in the SAM, but the folder keeps the name it received at first logon. Always join on the SID or RID, never on the name.

Worked example: tying the evidence together

A triage collection contains the following.

1. Link the SID to the SAM entry. ProfileList has the key S-1-5-21-1844237615-456351123-789044191-1002 with ProfileImagePath C:\Users\maria. The RID is 1002. In the SAM, the key 000003E9 converts as 0x3E9 = 3 × 256 + 14 × 16 + 9 = 768 + 224 + 9 = 1001. Its V value gives the user name maria.s, and Names\maria.s confirms it: the account was probably renamed after the profile was created. The machine prefix (2847193620-1735429082-3318874019) is the same in the other local accounts' SIDs, such as the Administrator's -500, which shows that this is a local account. The user's registry hive is C:\Users\maria\NTUSER.DAT.

2. Convert ShutdownTime. The 8 bytes are 00 24 E3 0D 08 B4 DC 01. Read little-endian, they give 0x01DCB4080DE32400 = 134,180,035,600,000,000 intervals of 100 ns. Divided by 10,000,000, that is 13,418,003,560 seconds since 1601. Subtracting 11,644,473,600 (the seconds from 1601 to 1970) gives Unix time 1,773,529,960, which is 2026-03-14T23:12:40Z.

3. Convert a local time. TimeZoneKeyName is E. South America Standard Time and ActiveTimeBias is 180 (Brasília, UTC−3, no daylight saving since 2019). A network profile's DateLastConnected is EA 07 03 00 06 00 0E 00 0E 00 1E 00 00 00 00 00: year 0x07EA = 2026, month 3, day of week 6 (Saturday), day 14, 14:30:00.000 local. UTC = local + bias = 14:30 + 180 minutes = 17:30, so 2026-03-14T17:30:00Z. The shutdown above was 20:12:40 local time.

Tools

Registry Explorer and RECmd (with a batch file such as Kroll_Batch.reb) read all of these values and convert their timestamps. RegRipper offers plugins per artifact, for example rip.exe -r SYSTEM -p timezone; others are compname and shutdown (SYSTEM), winver, profilelist and networklist (SOFTWARE) and samparse (SAM). Check key values in a hex view when an answer depends on them.

Exam focus: Expect to state the time zone from TimeZoneKeyName and the bias values and apply the sign convention UTC = local + bias, to identify Windows 11 from CurrentBuild despite a "Windows 10" ProductName, and to convert FILETIME and Unix epoch values to ISO 8601 UTC. Questions often ask for a user's SID or RID; join ProfileList and SAM through the RID in hex, not through folder names.

Key points

• Read SYSTEM\Select\Current to find the active control set; CurrentControlSet exists only on a live system.
• Establish the time zone first: UTC = local time + bias, with negative biases stored in two's complement and ActiveTimeBias valid only for one season.
• Windows 11 still reports "Windows 10" in ProductName; use CurrentBuild 22000 or higher, plus DisplayVersion and UBR.
• InstallDate (Unix seconds) and InstallTime (FILETIME) usually show the last feature update; earlier values survive under SYSTEM\Setup\Source OS.
• A local SID is S-1-5-21-<machine>-<RID>; the SAM key is the RID in eight hex digits, and ProfileList maps the SID to the profile folder.
• Domain accounts are not in the local SAM, and profile folder names may not match current account names.