Forum Discussion

bottsjw's avatar
bottsjw
New Member
5 years ago

One2Many registry changes for "CURRENT_USER" in a different user context than the authenticated user

We have tried various scripts to update our user's registry but the scripts seem to always run in the context of the account that has authenticated to run the script. This is less than ideal. Is the...
Problem
MaVeN's avatar
MaVeN
Contributor
In order to change anything in the HKCU registry range your need to be accessing the machine as that user so that those keys are effected. This is true with BAT or VBS. I am not sure if Powershell can provide a solution. Hope this helps.
randallcorn's avatar
randallcorn
Active Contributor
5 years ago

OK

 

So my machines are on a domain.  I don't have the users password so I cannot log in as them.  I do have domain admin credentials.  Do you have an example of how I can make a registry entry if I have this type of access?

 

Thanks,

 

Randall

  • KLumley's avatar
    KLumley
    New Member
    4 years ago

    This is less then ideal but it will work:

         -Open the LogMeIn Dashboard for the machine you're working with

         -Under Computer Management select Command Prompt

         -Run the following: reg load HKEY_USERS\ImportKyle "C:\Users\Kyle\ntuser.dat"

    The imported user hive will be visible at HKEY_USERS\ImportKyle

    From here you can manipulate the hive as usual

         - Get-ChildItem -Path Registry::HKEY_USERS\ImportKyle

         - Get-ItemProperty -Path Registry::HKEY_USERS\ImportKyle\Software\Microsoft\Office\Outlook

         - New-Item -Path Registry::HKEY_USERS\ImportKyle\Software\Microsoft\Windows\CurrentVersion\Test

     

    *The user will need to be logged out for this to work, only one process can lock the ntuser.dat file at a time.*