> For the complete documentation index, see [llms.txt](https://psmths.gitbook.io/windows-forensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/account-activity.md).

# Account Activity

{% content-ref url="/pages/SR93Ed5OolPqIElnPwwi" %}
[Account Creation Time](/windows-forensics/artifacts-by-activity/account-activity/creation-time.md)
{% endcontent-ref %}

{% content-ref url="/pages/PHoo4IxRnS9YMLtaOoOz" %}
[Group Membership](/windows-forensics/artifacts-by-activity/account-activity/group-membership.md)
{% endcontent-ref %}

{% content-ref url="/pages/HlxBEwdepRD9XWo5zvOO" %}
[Last Login](/windows-forensics/artifacts-by-activity/account-activity/last-login.md)
{% endcontent-ref %}

{% content-ref url="/pages/Zo5HzeeY0PwwSEjtwJ2Z" %}
[Login History](/windows-forensics/artifacts-by-activity/account-activity/login-history.md)
{% endcontent-ref %}

{% content-ref url="/pages/xrUgKsmrRTjjCfRttgUo" %}
[Logon ID](/windows-forensics/artifacts-by-activity/account-activity/logon-id.md)
{% endcontent-ref %}

{% content-ref url="/pages/la4cdnb3GjXGDL7pcWaV" %}
[Relative Identifier](/windows-forensics/artifacts-by-activity/account-activity/relative-identifier.md)
{% endcontent-ref %}

{% content-ref url="/pages/LRJZQZsAd12i4mDfGwuK" %}
[Security Identifier](/windows-forensics/artifacts-by-activity/account-activity/security-identifier.md)
{% endcontent-ref %}

{% content-ref url="/pages/xb2jtwMPGcVKWaKDBigr" %}
[Username](/windows-forensics/artifacts-by-activity/account-activity/username.md)
{% endcontent-ref %}