Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Getting the Username from the HKEY_USERS values

Is there a way to connect between the values under HKEY_USERS to the actual username?
I saw some similar questions, but most (if not all) talks about C# code, and my need is in VBScript.

like image 986
modz0r Avatar asked May 27 '10 07:05

modz0r


People also ask

How do I find my registry username?

Start the registry editor. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Select each SID under this in turn and look at the ProfileImagePath and at the end of this string is the name of the user.

Which registry key holds user profiles?

The registry contains a key called ProfileList located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion. This registry key contains one subkey for each user profile on a Windows machine.

Where in the registry are user accounts?

User accounts are stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList .

What is stored in HKEY_USERS?

HKEY_USERS, sometimes seen as HKU, is one of many registry hives in the Windows Registry. It contains user-specific configuration information for all currently active users on the computer. This means the user logged in at the moment (you) and any other users who have also logged in but have since "switched users."


2 Answers

If you look at either of the following keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist

You can find a list of the SIDs there with various values, including where their "home paths" which includes their usernames.

I'm not sure how dependable this is and I wouldn't recommend messing about with this unless you're really sure what you're doing.

like image 193
Hans Olsson Avatar answered Sep 22 '22 03:09

Hans Olsson


It is possible to query this information from WMI. The following command will output a table with a row for every user along with the SID for each user.

wmic useraccount get name,sid 

You can also export this information to CSV:

wmic useraccount get name,sid /format:csv > output.csv 

I have used this on Vista and 7. For more information see WMIC - Take Command-line Control over WMI.

like image 29
dcharles Avatar answered Sep 20 '22 03:09

dcharles