1

A user can log onto a machine from more than one domain. The sAMAccountNames, and therefore profile folder names, are the same in each domain. Looking at the profile folder contents, can I identify the name of the domain that the accounts belongs to. The domain name is not part of the folder name.

If not, is there any other way (e.g. registry) to identify it?

user2871239
  • 185
  • 2
  • 9
  • 1
    have you checked the NTFS permissions on the profile folder? That should reveal to which domain the user account belongs to. On command line you can simply execute `icacls.exe ` to get NTFS ACL for that folder. – Robert Sep 01 '22 at 09:48
  • 1
    Note that the profile folder itself often has a system owner like `SYSTEM` or `Administrators`, so it's better to look at one of the files and directories within. – Tilman Schmidt Sep 01 '22 at 11:53

1 Answers1

2

If the physical user has accounts with the same samAccountName in several domains and the machine accepts logins with all of them then Windows will create separate user profile folders for each of these accounts. As Windows does not allow two folders to have the same name, only the first of these profile folders will have exactly the name given by the samAccountName AD attribute. All others will have the AD domain name (or, in the case of a local account, the machine name) appended, separated by a dot. So you can identify the domain of all but one of the profile folders by looking at their names.

For the remaining profile folder, the one just named after samAccountName without a domain suffix, you can either proceed by exclusion, striking off from your list of domains all those appearing as a suffix until one remains which doesn't appear as a suffix and must hence be the unsuffixed profile folder's domain. Or you can look at the owner of the NTUSER.DAT file within the profile folder. This will be the user account in the domain to which the profile belongs.

Tilman Schmidt
  • 4,101
  • 12
  • 27