Getting the Username from the HKEY USERS values

Question

Is there a way to connect between the values under HKEY USERS to the actual username  I saw some similar questions  but most  if not all  talks about C  code  and my need is in VBScript

User · Answer

Open Reg HKEY LOCAL MACHINE SOFTWARE Microsoft Windows NT CurrentVersion ProfileList  make a loop to get all subkeys the subkeys you are interested with are those started with  S-1-5-21-  which means user  see key name  ProfileImagePath  they are always started with a path c  Users  Those starting with  S-1-5-21-12   are all local users Those starting with  S-1-5-21-13   are all network users  if joined to Domained network  that are previously logged on the machine

User · Answer

for  f  tokens 8 delims     a in   reg query  HKEY LOCAL MACHINE SYSTEM CurrentControlSet Control hivelist     find  UsrClass dat    do echo  a

User · Answer

By searching for my userid in the registry  I found   HKEY CURRENT USER Volatile Environment Username

User · Answer

The proper way to do this requires leveraging the SAM registry hive  on Windows 10  this requires NT AUTHORITY SYSTEM privileges   The information you require is in the the key  HKEY LOCAL MACHINE SAM SAM Domains Account Users Names    Each subkey is the username  and the default value in each subkey is a binary integer  This value  converted to decimal  actually corresponds to the last chunk of the of the SID    Take  Administrator  for example  by default it is associated with the integer 0x1f4  or 500     So  in theory you could take the build a list of SIDS based on the subkey names of the HKEY LOCAL MACHINE Software Microsoft Windows NT CurrentVersion ProfileList key and or  HKEY USERS key  parse out the the value after the last hyphen  -   and compare that to the info from the SAM hive   If you don t have NT AUTHORITY SYSTEM privileges  the next best way to approach this may be to follow the other method described in the answers here   reference  https   docs microsoft com en-us openspecs windows protocols ms-dtyp 81d92bba-d22b-4a8c-908a-554ab29148ab

User · Answer

You can use the command PSGetSid from Microsoft s SysInternals team   Download URL  http   technet microsoft com en-gb sysinternals bb897417 aspx  Usage    psgetsid    computer  computer          file   -u username  -p password     account SID  -u  Specifies optional user name for login to remote computer  -p  Specifies optional password for user name  If you omit this you will be prompted to enter a hidden password  Account PsGetSid will report the SID for the specified user account rather than the computer  SID PsGetSid will report the account for the specified SID  Computer    Direct PsGetSid to perform the command on the remote computer or computers specified  If you omit the computer name PsGetSid runs the command on the local system  and if you specify a wildcard        PsGetSid runs the command on all computers in the current domain   file   PsGetSid will execute the command on each of the computers listed in the file    Example   psgetsid S-1-5-21-583907252-682003330-839522115-63941   NB     Where the user is a domain AD LDAP  user  running this on any computer on the domain should give the same results  Where the user is local to the machine the command should either be run on that machine  or you should specify the computer via the optional parameter      Update  If you use PowerShell  the following may be useful for resolving any AD users listed    create a drive for HKEY USERS  New-PSDrive -PSProvider Registry -Name HKU -Root HKEY USERS -ErrorAction SilentlyContinue   List all immediate subfolders  where they re a folder  not a key   and they s an SID  i e  exclude  DEFAULT and SID Classes entries   return the SID  and return the related AD entry  should one exist   Get-ChildItem -Path  HKU              PSIsContainer -eq  true    -and     PSChildName -match   S-  d-           select   N  SID  E     PSChildName         N  Name  E  Get-ADUser    PSChildName   select -expand Name     You could also refine the SID filter further to only pull back those SIDs which will resolve to an AD account if you wished  more on the SID structure here  https   technet microsoft com en-us library cc962011 aspx

User · Answer

If you look at either of the following keys  HKEY LOCAL MACHINE SOFTWARE Microsoft Windows NT CurrentVersion ProfileList HKEY LOCAL MACHINE SYSTEM CurrentControlSet Control hivelist  You can find a list of the SIDs there with various values  including where their  home paths  which includes their usernames   I m not sure how dependable this is and I wouldn t recommend messing about with this unless you re really sure what you re doing

User · Answer

It is possible to query this information from WMI  The following command will output a table with a row for every user along with the SID for each user   wmic useraccount get name sid   You can also export this information to CSV   wmic useraccount get name sid  format csv  gt  output csv   I have used this on Vista and 7  For more information see WMIC - Take Command-line Control over WMI

User · Answer

In the HKEY USERS oneyouwanttoknow  you can look at  Software Microsoft Windows CurrentVersion Explorer Shell Folders and it will reveal their profile paths  c  users whothisis Desktop  etc

User · Answer

Done it  by a bit of creative programming     Enum the Keys in HKEY USERS for those funny number keys    Enum the keys in HKEY LOCAL MACHINE SOFTWARE Microsoft Windows NT CurrentVersion ProfileList    and you will find the same numbers     Now in those keys look at the String value  ProfileImagePath    SomeValue  where the values are either     systemroot  system32 config systemprofile     not interested in this one    as its not a directory path      SystemDrive  Documents and Settings LocalService -  Local Services   SystemDrive  Documents and Settings NetworkService  NETWORK SERVICE   or    SystemDrive  Documents and Settings USER NAME  which translates directly to the  USERNAME  values in most un-tampered systems  ie  where the user has not changed the their user name after a few weeks or altered the paths explicitly

[windows] Getting the Username from the HKEY_USERS values

Examples related to windows

Examples related to vbscript

Examples related to registry

Examples related to wmi