On Windows, a user account name would be different from the user profile name after it’s being changed from Control Panel.
How to find the original user profile name from a changed user account name?
There are two “name” properties of each account, so let me clarify things a bit so we don’t get confused. One is the SAM (Security Account Manager) account name, which shows up in the output of
net user. This is the name of the account as far as low-level OS components are concerned. The other is the display name, which shows up in Control Panel’s User Accounts page and in the Start menu. The Local Users and Groups snap-in for MMC (
lusrmgr.msc) shows both: the SAM name in the Name column, and the display name in the Full Name column. The SAM name is what’s used to produce the profile folder.
It is not very easy to change the SAM name unless you use this MMC snap-in. Only changes to the SAM name produce event 4781. I suspect, given that you don’t see an event 4781 in your log, that only the display name was changed. This only produces event 4738 (“a user account was changed”). Event 4738 only lists the new value for the display name, not the old value, and I suspect the history of display names isn’t kept anywhere (your best hope would be to dig through the logs for more instances of 4738).
Fortunately, finding the profile path from a display name isn’t too hard. Open PowerShell and type this command:
You get a bunch of entries that look like this:
AccountType : 512 Caption : <redacted>tester Domain : <redacted> SID : S-1-5-21-<redacted>-1018 FullName : Test Account Name : tester
Find the one with the
FullName showing the display name of the account. Then look at the
SID value (I’ve redacted my machine SID here). Open the Registry and navigate to the key mentioned by harrymc:
Open the subkey named the same as the SID you found. The
ProfileImagePath value holds the path to their profile folder.