CODEWITHSUNDEEP
powershell
ernits
ernits

Reputation: 21

Getting full registry key path from value with powershell

So I know, what value I am looking for, but I don't know the full path to that value, since its in

"HKLM\software\microsoft\windows nt\currentversion\profilelist", so user/profile ID?

So lets say I take a user called "computer_user_01". That means, that his "ProfileImagePath" is "C:\users\computer_user_01".

So lets say the full path to that value is: 

`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3548956479-1181130828-1993911463-1001\ProfileImagePath\C:\users\computer_user_01".

So I need the S-1-5-21-3548956479-1181130828-1993911463-1001\.

How can I get it from the ProfileImagePath key, C:\Users\computer_user_01 value ?

Right now I can query the ProfileImagePath key, but it gives me all users:

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath"

How can I specify it further, lets say this worked: 

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath" -Value "C:\users\computer_user_01"

Hope you can understand.

Upvotes: 2

Views: 2544

Answers (3)

JPBlanc
JPBlanc

Reputation: 72680

You can try the following :

# First I get the SID    
$sid = (gwmi win32_useraccount | ? {$_.name -eq "computer_user_01"}).SID
# Then the value of the property you look for
(Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\"   -Name "ProfileImagePath")

Upvotes: 2

Paxz
Paxz

Reputation: 3046

Ok you used Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\", each Object returned has an attribute ProfileImagePath and PSChildName, which hold everything you need.

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" | ? {$_.ProfileImagePath -eq "C:\users\computer_user_01"} | Select-Object -ExpandProperty PSChildName

Returns the wanted S-1-5-21-3548956479-1181130828-1993911463-1001

Explanation:

? {$_.ProfileImagePath -eq "C:\users\computer_user_01"} - Find the Object with the ProfileImagePath of you Path

Select-Object -ExpandProperty PSChildName - Output the name of the Object-Adult

Upvotes: 1

Theo
Theo

Reputation: 61208

You could do:

(Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath" | 
 Where-Object { $_.ProfileImagePath -eq 'C:\users\computer_user_01' }).PSChildName

Upvotes: 0

Related Questions