| Plugin | Hive | What it gives |
|---|---|---|
| samparse | SAM | Local users/groups |
| lastloggedon | SOFTWARE | Last logged-on user |
| netlogon | SYSTEM | Machine password changes |
| secrets | SECURITY | LSA secret timestamps |
| lsa | SYSTEM | LSA config |
| auditpol | SECURITY | Audit policy |
| profilelist | SOFTWARE | User Accounts |
BLUE TEAM / DFI / ARTEFACT / WINDOWS / REGISTRY / RegRipper