Windows – How to identify the (original) user profile name from a changed user account name in Windows

user-accountsuser-profileswindowswindows 10windows 7

On Windows, a user account name would be different from the user profile name after it's being changed from Control Panel.

How to find the original user profile name from a changed user account name?

Best Answer

There are two "name" properties of each account, so let me clarify things a bit so we don't get confused. One is the SAM (Security Account Manager) account name, which shows up in the output of net user. This is the name of the account as far as low-level OS components are concerned. The other is the display name, which shows up in Control Panel's User Accounts page and in the Start menu. The Local Users and Groups snap-in for MMC (lusrmgr.msc) shows both: the SAM name in the Name column, and the display name in the Full Name column. The SAM name is what's used to produce the profile folder.

It is not very easy to change the SAM name unless you use this MMC snap-in. Only changes to the SAM name produce event 4781. I suspect, given that you don't see an event 4781 in your log, that only the display name was changed. This only produces event 4738 ("a user account was changed"). Event 4738 only lists the new value for the display name, not the old value, and I suspect the history of display names isn't kept anywhere (your best hope would be to dig through the logs for more instances of 4738).

Fortunately, finding the profile path from a display name isn't too hard. Open PowerShell and type this command:

gwmi win32_useraccount

You get a bunch of entries that look like this:

AccountType : 512
Caption     : <redacted>\tester
Domain      : <redacted>
SID         : S-1-5-21-<redacted>-1018
FullName    : Test Account
Name        : tester

Find the one with the FullName showing the display name of the account. Then look at the SID value (I've redacted my machine SID here). Open the Registry and navigate to the key mentioned by harrymc:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Open the subkey named the same as the SID you found. The ProfileImagePath value holds the path to their profile folder.

Related Question