Access a specific user environment variable on windows server

Question

Is there a way to access to a specific user environment variable using Powershell ?

On the server machine, we have 50 users. I want to know if a specific user for example user1 is using a different value for the environment variable PYTH_HOME_LOG.

This System variable points to C:\PYTHON\LOG, I want to check which user changed this location by configuring a user environment variable PYTH_HOME_LOG.

Answer 1

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS\ |Where Name -like "HKEY_USERS\S-1-5-21*[0-9]"
foreach($UserHive in $AllUserHives){
  if(Get-ItemProperty -Path "$UserHive\Environment" -Name PYTH_HOME_LOG -EA SilentlyContinue){
    # User is overriding %PYTH_HOME_LOG%
  }
}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"
$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\\')[-1] -as [System.Security.Principal.SecurityIdentifier]
$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value