header1   header
header
header Register : : Login header
header
connector   connector
menuleft menuright
submenu   submenu
left
how to read a registry subkey
Last Post 19 Mar 2010 02:16 PM by mirth. 5 Replies.
Printer Friendly
  •  
  •  
  •  
  •  
  •  
Sort:
PrevPrev NextNext
You are not authorized to post a reply.
Author Messages
mirthUser is Offline
New Member
New Member
Posts:3
Avatar

--
05 Mar 2010 02:25 PM
    I've been asked to write a program to remotely delete user profiles.
    I've come across one problem.
    In my function, I can enumerate out the sids from the profile list easily enough. But I have to open each of the subkeys to see if the user can be deleted or not.

    #*=============================================
    Function Profilelist {
    $regKey=$regKey.OpenSubKey("SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList",$true)
    $Profiles=$regKey.GetSubKeyNames()
    foreach ($sid in $Profiles)
        {
    if ($sid.length -gt 8 )
    {
    $regkey=$regkey.OpenSubkey("SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\CentralProfile",$True)
    #$CentralProfiles=$regkey.get_ValueCount()
    }
        }
                        }
    #*=============================================
    I'm not sure how or if the regkey can use that string I'm trying to concatenate.
    All I am trying to do is read the CentralProfiles string value, and if is not user A B C or D then delete it
    I've also tried this
    $regkey=$regkey.OpenSubkey($sid,$True)
    if ($regkey.GetValueNames() -eq "CentralProfile")
    I get this error

    You cannot call a method on a null-valued expression.
    Does anyknow know how I can query the value of this registry into a string?
    $centralprofilelist=("SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\"+$sid+"\CentralProfile")

    PoSherLifeUser is Offline
    Basic Member
    Basic Member
    Posts:364
    Avatar

    --
    05 Mar 2010 02:46 PM
    Please post your entire script so we can see what happens before the function?
    When at first you don't succeed Step-Into

    http://theposherlife.blogspot.com
    http://www.jandctravels.com

    glnsizeUser is Offline
    Basic Member
    Basic Member
    Posts:193

    --
    05 Mar 2010 06:20 PM
    First things first, are you familiar with delprof? I would not remove profiles with a script, unless that script automated delprof. I don't like reinventing the wheel.... Plenty of new problems to solve.

    Having said that, you can accomplish what you're after like so;

    Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'| Where-object{$_.PSChildName.length -gt 8} | Get-ItemProperty -Name CentralProfile

    Hope that helps,
    ~Glenn
    PoSherLifeUser is Offline
    Basic Member
    Basic Member
    Posts:364
    Avatar

    --
    06 Mar 2010 11:47 AM
    GCI only works with local registrys, not remote.

    I totally agree with using existing apps (especially when they are free and supported) like delprof, the user hive profile cleanup service, and regunld for citrix.
    When at first you don't succeed Step-Into

    http://theposherlife.blogspot.com
    http://www.jandctravels.com

    mirthUser is Offline
    New Member
    New Member
    Posts:3
    Avatar

    --
    19 Mar 2010 09:46 AM
    Sorry it tool so long to reply. Delprofs doesn't quite do what we need it to do. there is a number of accounts that cannot be deleted or we're pooched. For example on our terminal servers, there are CTX accounts that cannot be deleted. So this code is to delete the profile list registries, then each associated folder.

    For example, the profile list on a computer is located at this registry location...
    <!--[if gte mso 9]> Normal 0 false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4 <!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4; mso-font-charset:1; mso-generic-font-family:roman; mso-font-format:other; mso-font-pitch:variable; mso-font-signature:0 0 0 0 0 0;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4; mso-font-charset:0; mso-generic-font-family:swiss; mso-font-pitch:variable; mso-font-signature:-1610611985 1073750139 0 0 159 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-unhide:no; mso-style-qformat:yes; mso-style-parent:""; margin:0in; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin;} .MsoChpDefault {mso-style-type:export-only; mso-default-props:yes; font-size:10.0pt; mso-ansi-font-size:10.0pt; mso-bidi-font-size:10.0pt;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in; mso-header-margin:.5in; mso-footer-margin:.5in; mso-paper-source:0;} div.Section1 {page:Section1;} --> <!--[if gte mso 10]> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    there is a subkey associated off that of the users sid, which mades that registry key look like this
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-484763869-790525478-839522115-500

    there is a key inside that registry entry called "CentralProfile"
    It contains the path to the users profile. So if it starts with \\ then its a network profile can be deleted.
    However I can't open that CentralProfile key. Its a reg_sz, so it should work!
    What compounds this problem, is that this registry is on a remote computer.
    So I got something like this to read the sid

    $MachineName = 'vm002'
    $MachineNamepath="\\"+$MachineName+"\c$\documents and settings"


    #* SCRIPT BODY
        #open up the remote machines's registry
        $regKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $MachineName)

    This opens the remote registry. then in a function
    This loads in the profile list registry keys$regKey=$regKey.OpenSubKey("SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList",$true)
    $Profiles=$regKey.GetSubKeyNames()

    I get all the sids this way

    foreach ($sid in $Profiles)
        {
    $regKey2=$regKey.OpenSubKey($sid)

    #if the sid is longer than 8 characters then   
        if ($sid.length -gt 8 )
            {
    #this is where i am stuck
    I need to read the value

    $CentralProfile=HKLM(of the remote machine from $regkey)\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-484763869-790525478-839522115-500\CentralProfile
    }
    I can do it with vbscript, but I just cant figure out how to do it with Powershell.
    Any ideas?



    mirthUser is Offline
    New Member
    New Member
    Posts:3
    Avatar

    --
    19 Mar 2010 02:16 PM
    got it

    #*=============================================
    Function Profilelist {
    $regKey=$regKey.OpenSubKey("SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList",$true)
    $Profiles=$regKey.GetSubKeyNames()
    foreach ($sid in $Profiles)
        {
    $regKey2=$regKey.OpenSubKey($sid)
       
        if ($sid.length -gt 8 )
            {
    Foreach($val in $regKey2.GetValueNames())
                {
        if ( $val -eq "CentralProfile"){ Write-Host $regKey2.GetValue("$val") }
                   }
            }
        }
                            }

    #*=============================================
    You are not authorized to post a reply.


    Active Forums 4.3
    right
    footer   footer
    footer Sponsored by Quest Software • SAPIEN Technologies • Compellent • Microsoft Windows Server 2008 R2 footer
    footer   footer