Find out if a local or Microsoft account was used for Win10 install?

Page 2 of 2 FirstFirst 12

  1. Posts : 4,821
    Windows 7 HP 64 - Windows 10 Pro - Lubuntu
       #11

    Try3 said:
    Luiz,

    Yes. If a user account is created as an MSAccount-linked user account then its C:\users\%userName% folder will, by default, be the first 5 characters of the MSAccount name / email address before th @ sign.

    Denis
    Thanks Denis
      My Computers


  2. Posts : 13,800
    Windows 10 Home x64 Version 22H2 Build 19045.2364
       #12

    Megahertz said:
    My Win 10 account is local but I read that users who has MS account has a C:\Users\UserName that is different from what is the login name.
    Luiz,

    I should also mention that the login uses the full email address of an MSAccount-linked user account but for other internal purposes, such as naming the user folder, Windows uses the shortened form of it. So, for example,
    Archibald.Snodgrass@Outlook.com would have a user folder
    Code:
    C:\Users\Archi
    and his UserName reported by Windows in response to
    Code:
    net user
    or
    Code:
    echo %UserName%
    would be
    Archi

    If you then used the command
    Code:
    net user Archi
    the FullName field would reveal the name he declared when the MSAccount was created, possibly Archibald Snodgrass, and this is also what would be displayed in the Start menu, Users section

    All the best,
    Denis
      My Computer


  3. Posts : 13,800
    Windows 10 Home x64 Version 22H2 Build 19045.2364
       #13

    pstein said:
    How can I now subsequently determine whether a Microsoft or a local account was used at that time?
    How are you getting on?

    I believe that posts #3 & #4 are your best best.

    Denis
      My Computer


  4. Posts : 109
    Win10
    Thread Starter
       #14

    I doubt that the (folder) creation date is meaningful to identify if an account is an MS account.

    What if I create an MS account just during the installation of Win10?

    It would have pretty much the same account creation timestamp as if I would create (and use a local account).

    Fiddling around if the account name is an email is not convincing too.

    I cannot believe that there is no other indicator.
      My Computer


  5. Posts : 13,800
    Windows 10 Home x64 Version 22H2 Build 19045.2364
       #15

    I did not claim that the folder's creation date showed it was an MSAccount.
    But if somebody created the account during installation then the properties I suggested you look at might match the installation date-time.
    - If the account's folder creation date-time matches the installation date-time then that account was used during installation.
    - If the account's password changed date-time matches the installation date-time then that account was used during installation.
    If that account is an MSAccount then installation was done with an MSAccount unless it was originally a local account and was converted to an MSAccount later on.

    I do not believe you will find anything more definitive than the [fallible] checks I have suggested.
    I can quite believe that there is no other indicator because I believe that it is not useful information.
    What difference would it make either way?


    All the best,
    Denis
      My Computer


  6. Posts : 1,365
    Windows 10 Pro (+ Windows 10 Home VMs for testing)
       #16

    pstein said:
    I doubt that the (folder) creation date is meaningful to identify if an account is an MS account.

    What if I create an MS account just during the installation of Win10?

    It would have pretty much the same account creation timestamp as if I would create (and use a local account).

    Fiddling around if the account name is an email is not convincing too.

    I cannot believe that there is no other indicator.
    If you don't like the answers so far then just identify the account name with the SID that ends in -1001 using the following command in a PowerShell console (doesn't have to be elevated):
    Code:
    Get-Ciminstance -class win32_useraccount | Select name,sid

    For example:
    Find out if a local or Microsoft account was used for Win10 install?-ps_get_sids.png

    SIDs are unique and this particular value (1001) represents the first user account that was created on the device during OOBE (Out Of the Box Experience), i.e. the user account (automatically in the Administrators group by default) that was used to set the device up after installation of the OS. If it doesn't correspond to a local account name then you know it was created by a MSA.

    You can confirm what I've just written by using Nir Sofer's RegScanner and searching for oobe. Sort the results by timestamp and you'll see the SID ending in 1001 is the first created user account.

    Alternatively, navigate in the registry to:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    In the profile list, select the SID ending in 1001 and read the ProfileImagePath value for the account name of the first created account.

    Hope this helps...
    Last edited by RickC; 08 Dec 2022 at 08:54.
      My Computer


  7. Posts : 27,105
    10 Home x64 (22H2) (10 Pro on 2nd pc)
       #17

    RickC said:
    If you don't like the answers so far then just identify the account name with the SID that ends in -1001 ...
    Good tip.

    If the owner had been forced to use a Microsoft account in the OOBE, then the easiest way to get only a local account would be to create a new local account, make it an administrator, then delete the first account. A clue that this had been done would be if the -1001 account was missing.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 03:46.
Find Us




Windows 10 Forums