Detections
Analytics
Windows Enumerate Accounts
info Nessus Plugin ID 171956
Language:
Synopsis
It is possible to enumerate Windows accounts on the host.Description
Nessus enumerates Windows accounts on the remote host. Account data comes from multiple sources including the local SAM registry hive, cached domain credential entries, and WMI or PowerShell user queries depending on scan mode.The logonTime field has source-dependent coverage:
- In a credentialed network scan against a member workstation or server, logonTime comes from NetUserGetInfo() over SMB. This source covers local accounts only. Domain accounts have no SAM entry on a member machine and return no logonTime from this source.
- On a domain controller, NetUserGetInfo() also covers domain accounts for the domain hosted on that controller.
- In an agent scan (and as a supplemental source in network scans), logon times come from the per-user profile load timestamps recorded locally in the registry. This source covers local and domain accounts that have a profile on the scanned host.
- An account that has never had an interactive logon has a logonTime of 0 when it comes from NetUserGetInfo(), and no logonTime value otherwise.
Other account attributes such as disabled status, lockout state, and password metadata are collected independently of logonTime and are available in all supported scan modes.
Plugin Details
Severity: Info
ID: 171956
File Name: windows_enum_accounts.nbin
Version: 1.101
Type: Local
Agent: windows
Family: Windows
Published: 2/28/2023
Updated: 10/14/2026
Asset Inventory: true
Supported Sensors: Nessus Agent, Nessus
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated