drop sam registry export or security evtx csv · timeline account creates disables password changes · correlate with logon events · runs locally
account data
drop evtx csv or SAM reg export
or click
4720 · 4722 · 4725 · 4723 · 4724 · 4624 — or reg export of SAM\Domains\Account\Users
drop security evtx csv or SAM .reg export