Shoutbox

Is there a way to change other users registry without actually having to log into them?


Thanks.

Sure -- you can find each of them under HKEY_USERS\<account SID>, so all you need to know is the SID.

One place you can go to match up the SIDs and accounts is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList -- although it doesn't contain account names directly, the ProfileImagePath entries there do unless the account has been renamed, and that should suffice.

Thanks!

I always have to go to File > Load Hive, then select the user's NTUSER.DAT file before I can access their registry.

quote:

---

Originally posted by WDZ
I always have to go to File > Load Hive, then select the user's NTUSER.DAT file before I can access their registry.

---

Thank you for pointing out my oversight.  That will be necessary if no processes are currently running under the user account in question.  If there are (a service account or fast user switching with the user logged on) the hive will be already loaded.

The exact steps for loading the hive are:

1) Select (highlight) HKEY_USERS in regedit.exe.  If you don't, the menu item for the next step will be disabled.

2) Use File -> Load Hive from the menu, navigate to NTUSER.DAT under the user's profile (presumably under C:\Documents and Settings\ folder).

3) You will be asked for a name to add the hive under -- it can be anything you like and will appear under HKEY_USERS.  I suggest the account name.

4) After you make your changes, select the loaded hive and use File -> Unload Hive.   That will insure your chages are saved.

If you attempt to load a hive already loaded, you will receive a message to the effect of the file being in use by another process.  In that case, you should proceed with the instructions I originally provided.

You can also change HKEY_LOCAL_MACHINE to edit for all users. It's usually what I do .

quote:

---

Originally posted by sljaxon
You can also change HKEY_LOCAL_MACHINE to edit for all users. It's usually what I do .

---

Not all keys exist in HKEY_LOCAL_MACHINE too. And in some software or cases the CURRENT_USER also overrides what is in LOCAL_MACHINE.