I’m trying to find a way to get a comprehensive list of user accounts on a Windows 7 system, including hidden ones. The User Accounts dialog (>control userpasswords2) only shows the normal user accounts, and even the Local User and Groups editor only shows normal user accounts and standard hidden/disabled ones like Administrator and Guest. The Select Users or Groups dialog has a Find Now button which which combines users and groups, but alas, it has the same contents as the LUG.

I’m looking for a more comprehensive list that includes “super-hidden” / virtual user accounts like TrustedInstaller (or to be more accurate, NT Service\TrustedInstaller—notice the different “domain”).

I checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList, but the SpecialAccounts key does not exist.

I also checked HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, and while it does have the SystemProfile, LocalService, and NetworkService accounts listed, it does not have others (like TrustedInstaller and its ilk).

TrustedInstaller specifically is a little confusing because it is a user, a service, and an executable file. I am using it as an example because it is “super hidden” in that it does not seem to be listed in any sort of user list. (As an experiment, I tried searching the whole registry for “trustedinstaller” to see if I could find a place where it is listed as a user, but found none.)

To be clear, what I am looking for is a list of all accounts that can be used in a user input-field such as in permissions dialogs or as a runas argument.