Map accounts to SIDs in ProfileList and hivelist, and list them with wmic useraccount.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelistThe profile must be loaded first to show up in `HKEY_Users`.- Users —
S-1-5-21-. - Local users —
S-1-5-21-12. - Domain Users —
S-1-5-21-13.
wmic useraccount get name,sidUpdated:
2026 Aug 19

