Where does the command Net Users acquire its list of usernames?

[Modifyinc]

Where does the command net users acquire its list of usernames?

 

I'm curious now, because it is showing the username Drew that I can't find anywhere in Windows.

 

1. Not listed under the ProfileList in the registry

2. Not shown in the Windows Users Accounts

3. Not found in the Users directory of the drive

I ran net user drew, and I now see where it came from due to this comment left by the software that created it.

Comment "For EaseUS Todo Backup Central Management Console"

I know I can easily remove this username using the net command, but I'm more curious how net users is finding this username when it's not even listed under the ProfileList in the registry.

 

Update:

After doing a search through the registry, I found the username was listed under Winlogon>SpecialAccounts. Though it was just the name, so still not sure how the net user command still showed the user's details when I typed net user drew. I deleted the entry and rebooted, and now the username is showing under the Windows User Account, though it is still not present under the ProfileList in the registry. I'm assuming this is b/c I have never logged into this account, and the key will not be created until I do.

 

Edited August 28, 2022 by Modifyinc

[GoodBytes]

The registry that you have easy access to via regedit (Registry Editor), doesn't load allll registry collections. 

 

SAM (Security Account Manager) registry is the registry collection that handles accounts login and permission, and that one is inaccessible by any user from Windows. It can only be accessed outside (Windows, not loaded), such as another OS or Windows Setup / Recovery.

 

Your account Dan, should be viewable through the advanced panel of netplwiz panel (Start/Search > type: netplwiz > hit enter/return key). If not, then that account wasn't deleted using normal means. If you never created that account, nor someone you know, it could be from a form of malware that you have or had.