Printable View
Ok, I searched a bit for this but haven't found the answer i'm looking for yet...
You can see what is in hkey_current_user while loged in as that user, but my question is: Where is that information stored when your not log'd on as that user? Say I want to see what is in hkey_current_user for account: cross and I am log'd in as Administrator. Is there a way to find out whats there other then logging on as that user?
Thanks in advance!
It's stored in the user's profile. It's the ntuser.dat file.
If the user is currently logged on you can find his/her SID under HKEY_USERS.
u can find it here :
Goto start --> Run and type Regedit :)
just dont ***** alot with it , u may crash ur computer :)
regedt32
highlight Current_User
File
Load Hive
This sounds like what I needed, but I can only "Load Hive" under Hkey_users. when hkey_current_user is highlighted the Load Hive option is greyed out.Quote:
I'm sorry, you have to unload the hive first. You have to be logged on as Local Admin. Just like me to leave out steps - my bad
Ok, Unload hive is grey'd out on all hives, and Load hive is only selectable on Hkey_users and Hkey_current_config. I am loged in as Administrator, and this is WinXP pro if that makes any difference. I know what your saying to do is probably what I need but it's not working!Quote:
Originally posted here by dinowuff
I'm sorry, you have to unload the hive first. You have to be logged on as Local Admin. Just like me to leave out steps - my bad
Thanks again for all the replies!
c'mon guys!
Sounded like we almost had the right answer, but as I said, the options i need are greyed out!!! Anyone know what to do?
You're logged in as the local admin or as a network admin?
Hey Hey,
What dinowuff is saying definately works..
I used regedt32.exe instead of regedit... I dunno if it makes a difference...
1. Open regedt32.exe (or try regedit.exe)
2. Click on HKU
3. Go to File --> Load Hive
4. Browse to the other users profile and select ntuser.dat
5. Enter the username (or any other unique name... just username makes it easily identifiable) in the dialog-box.
6. Expand HKU and you'll see a the name you entered...
7. Expand the username key
8. Expand HKCU. (Notice that the HKU\<username> and HKCU have the same keys.... It's that users HKCU hive, you just have to load/mount it under HKU)
9. Play with HKU\<username> to your hearts content.
Peace,
HT
Ok, i've tried this numerous times on a ton of different machines, and on ALL machines the load and unload hive options are greyed out (at least on the Hkey_current_user). I've tried this both as a local Administrator and a domain admin. Is this not working because the computers are all joined to a domain? I don't understand how it can work for both of you and not work for me on any of our 500 machines here.... there can't be something wrong with all of them. Next time I setup a computer I will try this before we add it to the domain, but if that doesn't work, any other suggestions?
Other than not having HKLM highlighted before selecting File | load hive, ???
There are registry hacks that will prevent the use of windows registry editing tools, but I don't see that to be the case for over 500 pc's.
Sorry I Couldn't be more help. Anyone?
"Other than not having HKLM highlighted before selecting File | load hive, ???"Quote:
Ok, i think i see what the problem is... I dont need to have HKEY_current_user highlighted? When i load the 'hive' it will have all the hkeys for that user right..? I was assuming that if i wanted to see their current user branch, than it would need to be highlited when i hit load hive...