How to map HKEY_USERS subkeys and Windows usernames?

Question

I thought the key names immediately below HKEY_USERS were supposed to be the usernames of whoever logged in at this machine at some time. But in my machine what appears is:

S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN_Classes

I'd like to be able to determine which subtree corresponds to which user. How can I do that?

Edit: WHat I need is to get the usernames from the SIDs. I want to inspect the configurations of each user that has ever logged on, and I need to know their names. For example, in the registry above, I need to be able to, based on the string "S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN", find out that it correspond to DOMAIN\somebody, or LOCALMACHINENAME\somebodyelse.

Answer 1

It is possible to query this information from WMI. The following command will output a table with a row for every user along with the SID for each user.

wmic useraccount get name,sid

You can also export this information to CSV:

wmic useraccount get name,sid /format:csv > output.csv

I have used this on Vista and 7 (according to the comments it works on 2008 R2 as well). For more information see WMIC - Take Command-line Control over WMI.

Answer 2

I believe those numbers are the user's security ID (SID). You can use SysInternals to get the SIDs of users:

http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx

Answer 3

For PowerShell this is quick:

gwmi win32_userprofile | ft localpath, sid

Ashley McGlone Microsoft PFE http://aka.ms/GoateePFE