It can do pretty much everything CMD can do and so much more.

This is a continuation of my last blog post Modifying the Registry of Another User.

As a quick refresher, we learned how to modify a users registry (HKEYCURRENT USER or HKEYUSERS) without having that user logged onto a machine.

We had to load and unload their NTUSER.DAT file separately in the HKEYUSERS registry hive.

Now, were going to add to that excitement by learning how to do it for all users instead of only specific users.

Before we can modify the registry for all users, we need to be able to go out and grab all the ntuser.dat files so that we can load them as we did in the last blog post.

Youre thinking thats easy We know that the ntuser.dat file is in the C:Users directory, so that should be as simple as searching through C:Users for any ntuser.dat file, right This will only work if nobody is logged into a machine.

We have to take into consideration any currently-logged on users.

There is also a disconnected user Reg who forgot to log off: If I try loading Regs ntuser.dat, I encounter an error telling me that ntuser.dat is already being used by something else.

So, what do we do We need to find all users on a machine and compare it with all currently-logged on user security identifiers (SIDs).

Find all users and their SIDs Fortunately for us, there is a convenient location in the registry that stores the users on a machine and their SIDs.

HKLMSOFTWAREMicrosoftWindows NTCurrentVersionProfileList This location will have a list of all the SIDs for a machine as well as some other properties.

Notice that you see the two SIDs from an earlier screenshot: From this, we are able to use regular expressions and some calculated properties to select some great information with PowerShell.

Well use the Get-ItemProperty cmdlet to get that information from the registry.

ProfileImagePath -replace (.), Now we have a list of the usernames and their associated SIDs.

Getting SID of users in HKEYUSERS Next, well need to compare those SIDs with the SIDs of the users that are currently logged on and have their registrys loaded to HKEYUSERS (see Get-ChildItem ): Get-ChildItem Registry::HKEYUSERS Where-Object.

Putting it all together Now, we just need to compare the two lists of SIDs and well be able to modify the registry at will.

Ive compiled it all into a template that somebody could use to read or modify the registry of each user on a machine.

Find Users In Regedit Software As Well

In my example, I load each registry (if not loaded) and attempt to read the Uninstall key at HKCU:SoftwareMicrosoftWindowsCurrentVersionUninstall This will show me which users have per-user installs of software as well as the software name: Regex pattern for SIDs.

It is never wise to modify the registry without a good reason, and even some good reasons arent always great justification.

In other words, be responsible and test your scripts before using on production systems.

We cannot be held responsible for any issues that you may encounter.

Find Users In Regedit Series On PowerShell

Happy PowerShelling Did you know that PDQ Deploy has a PowerShell step you can use to deploy your scripts This blog post is part of a series on PowerShell: Mapped Drives User Profile Size History of Logged on Users Windows Defender Count Installed Microsoft Store Apps Windows Updates How to Write Your First Powershell Script How to Add Printers with Powershell Searching Through Files for Matching Strings Get-Date Cmdlet Get-Command and Get-Member Get-Help Console Window Tips Get CPU Usage for a Process Using Get-Counter Sending Email (with Gmail example) Zip up files using.NET and Add-Type Text-to-Speech Examples Silently Change Firefox Default Search Providers Copying Individual Files and Renaming Duplicates Sending a Wake-On-LAN (WOL) Magic Packet Secure Password with PowerShell: Encrypting Credentials - Part 1 Secure Password with PowerShell: Encrypting Credentials - Part 2 Create Shortcuts on User Desktops using Powershell Using PowerShell to Set Static and DHCP IP Addresses - Part 1 Using PowerShell to Set Static and DHCP IP Addresses - Part 2 Capturing Screenshots with PowerShell and.NET Using Get-ChildItem to Find Files by Date and Time Exploring Event Logs with Get-EventLog PowerShell Ready to put the PowerShell Scanner through its paces Take our 14-day Free Trial.

Start a Trial Dont miss the next post Join Whats The GPUpdate CMD Equivalent In PowerShell February 10, 2021 PowerShell is taking over and you should be using it.