Solved

Windows Profiles

Posted on 2004-09-07
15
224 Views
Last Modified: 2012-05-05
Hi,

His there a registry key that will list all user profiles installed on the current computer?

Thanks.
MrClean
0
Comment
Question by:MrClean21
  • 5
  • 4
  • 3
  • +2
15 Comments
 
LVL 25

Assisted Solution

by:mikeleebrla
mikeleebrla earned 200 total points
ID: 12000305
sure,, its not a registry key though,,, all you have to do is look at C:\documents and settings\   all profiles including system profiles are stored there.
0
 
LVL 4

Author Comment

by:MrClean21
ID: 12000375
mikeleebrla,

I need a registry entry cause I'm trying to list all installed users profiles on a computer using SMS.

Regards
MrClean
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 12000410
well to the best of my knowlege there is no such key,, When a user logs in windows looks in C:\documents and settings\ for the users profile,,, if it isn't there then one is created for them from the default user profile.
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 4

Author Comment

by:MrClean21
ID: 12000451
mikeleebrla,

well would you know a WMI classes which can list all users profiles on a computer?
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 12000479
no sorry
0
 
LVL 15

Assisted Solution

by:Yan_west
Yan_west earned 100 total points
ID: 12000497
From http://www.windowsitlibrary.com/Content/224/1.html

HKCU: A Special Case
When users log on to a Win2K workstation, the part of the user profile that stores personal preferences and application configuration information — namely the ntuser.dat file — is temporarily loaded into the Registry as HKCU. You notice that if you connect to a remote Win2K Registry using a tool like regedt32, HKCU — and HKCR — are unavailable. HKCU and HKCR are only available if you are physically at the machine. However, you can view HKCU indirectly through its root subtree, by expanding HKU\<SID Value> for the logged-on user (Figure 3).

The long numbers, beginning with S-1-5-21, are the currently logged on user’s SID. The reason there are two keys for a given user, one suffixed by _Classes, involves a new feature in Win2K that I discuss later in this chapter. For each user logged on to the system, you see these two keys loaded under HKU, prefixed by the user’s SID.

0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 12000532
but that still doesn't list all the profiles... just users that are currently logged in.
0
 
LVL 15

Expert Comment

by:Yan_west
ID: 12000551
Exactly, there is nothing else.. I wrote that just to show you what was related to the user profile in the registry...

What do you need that for? we could find you an alternative..
0
 
LVL 84

Assisted Solution

by:oBdA
oBdA earned 100 total points
ID: 12000576
The names in the profile folder are unreliable; they might differ from the actual user name.
The actual list of whose profiles are stored on the machine is in the registry, at HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList.
Here you will find a number of keys with the SIDs of the accounts with profiles on this machine.
So all you have to do is enumerate these SIDs and resolve them to the account names.
0
 
LVL 4

Author Comment

by:MrClean21
ID: 12000641

The best I would like to have is the list of the last 3 usernames who logged on the computer.
What I was asking for is the list of all profiles usernames installed on the computer. I'm using WMI with SMS2003 so I cannot list directory.

How can I retieve the name from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList?

I just found that using Win32_UserAccount WMI class, I can have the list of username, but I don't have the logon time...

MrClean

0
 
LVL 9

Accepted Solution

by:
jdeclue earned 100 total points
ID: 12000714
The last logon time is maintained on the Domain Controller which handled their last logon. So if you wish to find the logon, you have to run a query against all DC's that could have authenticated the user and take the most recent. SMS does this by default, if it is set to track the user logon by domain. I would take my list of users, and then match them up against the SMS database for last logon.

J
0
 
LVL 4

Author Comment

by:MrClean21
ID: 12004943
I don't want to know where they log on, but who was the 3 last person who log on a computer.

MrClean
0
 
LVL 9

Expert Comment

by:jdeclue
ID: 12005825
Sorry, I misread. If you have access to the machines filesystem and you have the profile name, then you should be able to check the modify date on the NTUSER.DAT file. "%SystemDrive%\Documents and Settings\ProfileName\NTUSER.DAT". It should get modified each time they logoff the machine.

Hope that helps

J
0
 
LVL 15

Expert Comment

by:Yan_west
ID: 12005857
what you could do is code a small program that logs the last user that came in in a small text file, along with the time of the logon... You would run this application in a login script, or in the startup folder of the machine.

The value of the curently logued on user is at: HKCurrent user / software / microsoft / windows / explorer / Logon user name key (Reg_SZ value)


then you would only have to open this text file, and consult the list..
0
 
LVL 4

Author Comment

by:MrClean21
ID: 12064616
Thanks everyone for your effort.

MrClean
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
The business world is becoming increasingly integrated with tech. It’s not just for a select few anymore — but what about if you have a small business? It may be easier than you think to integrate technology into your small business, and it’s likely…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question