> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/enumeration/trick-0315/information-gathering-enumeration-windows.md).

# Windows

## Osquery Query Windows Registry For User SID

Use `osquery` to query the Windows registry table `registry` for entries under the `HKEY_USERS` key. This will list user Security Identifiers (SIDs) and default user configurations. The `registry` table provides access to Windows registry keys and values, separating them into different columns.

```sql
SELECT path, key, name FROM registry WHERE key = 'HKEY_USERS';
```

The output will include paths or keys corresponding to user profiles, from which you can identify the full SID for a specific user, often recognizable by its Relative Identifier (RID) suffix (e.g., a SID ending in `-1009`).

To map these SIDs to actual user profile paths and potentially usernames, you can query the `ProfileList` key located under `HKEY_LOCAL_MACHINE`.

```sql
SELECT path, name, data FROM registry WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList';
```

The `registry` table includes columns such as `key` (the full path to the registry key), `path` (the path within the key), `name` (the registry value name), `type` (the data type of the value), `data` (the value itself), and `mtime` (modification time).

For a more direct mapping of SIDs to usernames, you can join the `registry` table with the `users` table. The `users` table provides information about local and domain users, including their SID. The `HKEY_USERS` hive contains user-specific configuration information.

```sql
SELECT users.username, users.sid, registry.path, registry.name, registry.data
FROM registry
JOIN users ON users.sid = registry.key
WHERE registry.key LIKE 'HKEY_USERS\%'
AND registry.path = 'Volatile Environment'
AND registry.name = 'USERNAME';
```

This query specifically looks for the `USERNAME` value within the `Volatile Environment` subkey under each user's SID in `HKEY_USERS`, joining it with the `users` table on the SID to retrieve the corresponding username. A Security Identifier (SID) is a data structure that uniquely identifies user, group, and computer accounts. The structure includes a variable number of subauthority values or relative identifiers.