HKEY_USERS contains only logged in users

Question

I am writing a c# application.

As part of my application, I need to read the users' profiles.

In order to get all the users, I am using Registry.Users.GetSubKey().

The problem is that on Windows 8 the HKEY_USERS contains only logged in users! (when there is 2 users logged in I wiil see 2 users under HKEY_USERS, but if one of the users will sign out, then there will be only 1 user under HKEY_USERS)

As a result, I get the profiles only for logged in users.

I tried to search the entire registry to find where the data is saved, but I can't find this information anywhere.... it seems like the info is gone when the user logs out.

Is it by design, or a bug?

Where the data is saved - it must be in the registry, but I can't find it...

Could it be something in the permissions? Maybe the info is there but it's hidden when the user is not logged in? Is there a flag or something I can use to read the profile for non logged in users?

Is the users reg not under the `S-1-5` keys under `HKU`? There are keys for each user on my pc even though I'm the only one logged in. — Bali C, Jul 11 '12 at 11:37
Are you using win8? anyhow, users such as S-1-5-18, S-1-5-19, etc. are not regular users, they are users like System, local service, etc. — user844541, Jul 11 '12 at 11:44
Apologies, I am using Win7, I wasn't aware that 18, 19 etc weren't regular accounts. You learn something new everyday! — Bali C, Jul 11 '12 at 11:47
If a user is not logged on, then his user profile is not loaded. (What would be the point of loading the profile of a user who isn't logged on? Imagine how expensive this would be on a domain controller with 10,000 users.) Please explain why you think you need to access profiles of users other than the current user. — Raymond Chen, Jul 11 '12 at 13:19

Zombo · Answer 1 · 2020-07-02T15:39:03.533

8

This may not work in all cases, but has suited my needs. Load Registry Hive

reg load HKU\Steven C:\Users\Steven\ntuser.dat

Read necessary data, then unload

reg unload HKU\Steven

edited Jul 02 '20 at 15:39

answered Aug 20 '14 at 06:47

Zombo

1
62
391
407

Thanks! Very useful solution. – VoidVolker Oct 21 '15 at 21:19
Fail, works bad - it opens in read only for unknown reason. I found other way: start programm from SYSTEM user: nircmd.exe elevatecmd runassystem and in HKU will contain all users. – VoidVolker Nov 12 '15 at 17:23

score 6 · Accepted Answer · answered Jul 11 '12 at 13:06

As part of my application, I need to read the users' profiles.

Then you need to redesign your application. What you're asking for is not possible.

From Raymond Chen's blog post, "Beware of roaming user profiles":

[Y]ou cannot just cruise through the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList registry key expecting to find all the user profiles and possibly even modify them, because the copy of the user profile on the local computer might not be the authoritative one.

Anything you see on your local machine relating to other users' profiles -- whether under HKEY_USERS, or in their profile directories under C:\Users -- is just a local cache from the last time they logged in on that machine. The real data, the up-to-date data, is stored on a domain controller somewhere.

You can't rely on other users' locally-stored profile data for anything at all. You're better off pretending it's not even there.

So how can I obtain this data? – user844541 Jul 11 '12 at 13:30 — user844541, Jul 11 '12 at 13:30

HKEY_USERS contains only logged in users

2 Answers2