Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 244
  • Last Modified:

Windows Profiles

Hi,

His there a registry key that will list all user profiles installed on the current computer?

Thanks.
MrClean
0
MrClean21
Asked:
MrClean21
  • 5
  • 4
  • 3
  • +2
4 Solutions
 
mikeleebrlaCommented:
sure,, its not a registry key though,,, all you have to do is look at C:\documents and settings\   all profiles including system profiles are stored there.
0
 
MrClean21Author Commented:
mikeleebrla,

I need a registry entry cause I'm trying to list all installed users profiles on a computer using SMS.

Regards
MrClean
0
 
mikeleebrlaCommented:
well to the best of my knowlege there is no such key,, When a user logs in windows looks in C:\documents and settings\ for the users profile,,, if it isn't there then one is created for them from the default user profile.
0
[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

 
MrClean21Author Commented:
mikeleebrla,

well would you know a WMI classes which can list all users profiles on a computer?
0
 
mikeleebrlaCommented:
no sorry
0
 
Yan_westCommented:
From http://www.windowsitlibrary.com/Content/224/1.html

HKCU: A Special Case
When users log on to a Win2K workstation, the part of the user profile that stores personal preferences and application configuration information — namely the ntuser.dat file — is temporarily loaded into the Registry as HKCU. You notice that if you connect to a remote Win2K Registry using a tool like regedt32, HKCU — and HKCR — are unavailable. HKCU and HKCR are only available if you are physically at the machine. However, you can view HKCU indirectly through its root subtree, by expanding HKU\<SID Value> for the logged-on user (Figure 3).

The long numbers, beginning with S-1-5-21, are the currently logged on user’s SID. The reason there are two keys for a given user, one suffixed by _Classes, involves a new feature in Win2K that I discuss later in this chapter. For each user logged on to the system, you see these two keys loaded under HKU, prefixed by the user’s SID.

0
 
mikeleebrlaCommented:
but that still doesn't list all the profiles... just users that are currently logged in.
0
 
Yan_westCommented:
Exactly, there is nothing else.. I wrote that just to show you what was related to the user profile in the registry...

What do you need that for? we could find you an alternative..
0
 
oBdACommented:
The names in the profile folder are unreliable; they might differ from the actual user name.
The actual list of whose profiles are stored on the machine is in the registry, at HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList.
Here you will find a number of keys with the SIDs of the accounts with profiles on this machine.
So all you have to do is enumerate these SIDs and resolve them to the account names.
0
 
MrClean21Author Commented:

The best I would like to have is the list of the last 3 usernames who logged on the computer.
What I was asking for is the list of all profiles usernames installed on the computer. I'm using WMI with SMS2003 so I cannot list directory.

How can I retieve the name from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList?

I just found that using Win32_UserAccount WMI class, I can have the list of username, but I don't have the logon time...

MrClean

0
 
jdeclueCommented:
The last logon time is maintained on the Domain Controller which handled their last logon. So if you wish to find the logon, you have to run a query against all DC's that could have authenticated the user and take the most recent. SMS does this by default, if it is set to track the user logon by domain. I would take my list of users, and then match them up against the SMS database for last logon.

J
0
 
MrClean21Author Commented:
I don't want to know where they log on, but who was the 3 last person who log on a computer.

MrClean
0
 
jdeclueCommented:
Sorry, I misread. If you have access to the machines filesystem and you have the profile name, then you should be able to check the modify date on the NTUSER.DAT file. "%SystemDrive%\Documents and Settings\ProfileName\NTUSER.DAT". It should get modified each time they logoff the machine.

Hope that helps

J
0
 
Yan_westCommented:
what you could do is code a small program that logs the last user that came in in a small text file, along with the time of the logon... You would run this application in a login script, or in the startup folder of the machine.

The value of the curently logued on user is at: HKCurrent user / software / microsoft / windows / explorer / Logon user name key (Reg_SZ value)


then you would only have to open this text file, and consult the list..
0
 
MrClean21Author Commented:
Thanks everyone for your effort.

MrClean
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 4
  • 3
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now