> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage.md).

# Account Usage

- [Authentications SAM Artifacts](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-sam-artifacts.md)
- [Last Login](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-sam-artifacts/last-login.md)
- [Last Failed Login](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-sam-artifacts/last-failed-login.md)
- [Last Password Change](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-sam-artifacts/last-password-change.md)
- [Authentications (Windows Event Log)](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-windows-event-log.md)
- [Logon ID](https://windows.dfirhandbook.com/windows-artifacts/account-usage/authentications-windows-event-log/logon-id.md)
- [Group Membership](https://windows.dfirhandbook.com/windows-artifacts/account-usage/group-membership.md)
- [Event ID: 4798](https://windows.dfirhandbook.com/windows-artifacts/account-usage/group-membership/event-id-4798.md)
- [Event ID: 4799](https://windows.dfirhandbook.com/windows-artifacts/account-usage/group-membership/event-id-4799.md)
- [RDP](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rdp.md)
- [Source System Artifacts - Quick Reference](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rdp/source-system-artifacts-quick-reference.md)
- [Destination System Artifacts - Quick Reference](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rdp/destination-system-artifacts-quick-reference.md)
- [SSH](https://windows.dfirhandbook.com/windows-artifacts/account-usage/ssh.md)
- [Rouge Local Accounts](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rouge-local-accounts.md)
- [CrowdStrike Searches](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches.md)
- [Event Name - UserLogon](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogon.md)
- [Event Name - UserLogonFailed](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogonfailed.md): UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data.
- [Event Name - UserLogonFailed2](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogonfailed2.md): UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data.
- [Event Name - SsoApplicationAccess](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-ssoapplicationaccess.md)