delete registry under user sid

tkr99 · 2021-08-05T15:18:08.000Z

Hello, we are trying to delet reg key that is under user sid, is that possible using poswershell.

Regards

Neally · 2021-08-05T15:20:04.000Z

What have you tried? Where are you stuck?

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

tkr99 · 2021-08-05T15:25:56.000Z

I have not started yet

Neally · 2021-08-05T15:26:58.000Z

tkr99:

I have not started yet

so… you need help with something you have not even started yourself yet… ?

Give it a try, if you get stuck post what you have tried.

We’re happy to help but not a script writing service…

GDaddy · 2021-08-05T15:28:42.000Z

Should be able to use a GPO to do that. Just make a User Policy under Preferences - windows settings - registry - just set it to delete

tkr99 · 2021-08-05T16:04:16.000Z

i google and got this, but the powershell will be running as system account so it will get that sid right and user one

function Get-CurrentUserSID {            
[CmdletBinding()]            
param(            
)            
            
Add-Type -AssemblyName System.DirectoryServices.AccountManagement            
return ([System.DirectoryServices.AccountManagement.UserPrincipal]::Current).SID.Value            
            
            
}

Get-CurrentUserSID

tkr99 · 2021-08-05T18:35:08.000Z

if(!(Test-Path 'HKU:\')) {
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
}
Push-Location
$path = Get-ChildItem -Path 'HKU:\*\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction SilentlyContinue | ForEach-Object {
Remove-ItemProperty -Path $path -name "AutoconfigURL" -force }

came up with this but throwing error

gary-m-g · 2021-08-06T17:47:02.000Z

To work with someone else’s Registry data when they’re not logged in, you have to load their hive: to wit… Modify registry of another user

DoctorDNS · 2021-08-08T13:24:08.000Z

So to begin to understand the real answer, you have to understand the registry. The HKEY_USERS hive contains the peruser settings for each user on the system. At logon, WIndows maps one of those sub-hives and exposes the handle HKEY_CURRENT_USER, which powershell maps to HKCU: Widnwos also maintains ACLs to keep one user from interfering with another. So if Jerry and Sarah both logon to a host, neither can see the other’s registry components. Memberts of ther Administrators local group should have access to all the keys below HKEY_USERS.

In PowerShell you can create a drive to HKEY_USERS like this:

PS C:\Foo> New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS

Name           Used (GB)     Free (GB) Provider      Root                                               CurrentLocation
----           ---------     --------- --------      ----                                               ---------------
HKU                                    Registry      HKEY_USERS

PS C:\Foo> cd hku:
PS HKU:\> ls

    Hive: HKEY_USERS

Name                           Property
----                           --------
.DEFAULT
Get-ChildItem: Requested registry access is not allowed.
Get-ChildItem: Requested registry access is not allowed.
S-1-5-21-2550804810-443649076-
1856842782-1106
S-1-5-21-2550804810-443649076- EditFlags : {0, 0, 0, 0}
1856842782-1106_Classes
S-1-5-18