Cloud Account Details

Location and Format

The SAM hive will contain information about the Microsoft Cloud Account.

• SAM\Domains\Account\Users<RID>\InternetUserName

Purpose

Microsoft Cloud Accounts have their information stored in the SAM hive, this includes the email address that is used for the account.

Forensic Uses

The above registry key contains the email that is associated with the account. If this key is present it indicates that this account is a Microsoft Cloud Account.

Analysis Tools

Example Analysis

pending