Update HKCU Registry from the System Account using PowerShell

0
23

If you want to Update HKCU Registry from the System Account for the current logged on user HKEY_USERS hive. Use the below code. I found this after lot of research.

 $explorers = Get-WmiObject -Namespace root\cimv2 -Class Win32_Process -Filter "Name='explorer.exe'"
 $explorers | ForEach-Object {
       $owner = $_.GetOwner()
       if($owner.ReturnValue -eq 0) {
          $user = '{0}\{1}' -f $owner.Domain, $owner.User
          $ntAccount = New-Object -TypeName System.Security.Principal.NTAccount($user)
          $sid = $ntAccount.Translate([System.Security.Principal.SecurityIdentifier]).Value
          Write-host $sid
      }
 }

LEAVE A REPLY