Search notes:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
LastLoggedOnUser and LastLoggedOnSAMUser
These values seem to reveal the last logged on
user
.
Index