How to map HKEY_USERS subkeys and Windows usernames?

Question

I thought the key names immediately below HKEY_USERS were supposed to be the usernames of whoever logged in at this machine at some time. But in my machine what appears is:

S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN_Classes

I'd like to be able to determine which subtree corresponds to which user. How can I do that?

Edit: WHat I need is to get the usernames from the SIDs. I want to inspect the configurations of each user that has ever logged on, and I need to know their names. For example, in the registry above, I need to be able to, based on the string "S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN", find out that it correspond to DOMAIN\somebody, or LOCALMACHINENAME\somebodyelse.

Answer 1

I believe those numbers are the user's security ID (SID). You can use SysInternals to get the SIDs of users:

http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx

Answer 2

HKLM\System\CurrentControlSet\Control\hivelist will show you where the hives are mounted from. While not a direct mapping, usually the mount point has the user name in the path.

I'm sure there is a better answer than this though...

Answer 3

When doing it manually (without extra tools), the easiest way is to open permissions for that key. The only user who has full permissions is the owner of the key.

When from a program, you will need a way to convert SIDs to account names. In C# (or PowerShell), have a look at the SecurityIdentifier and NtAccount class for that.

Answer 4

Check out the answer to this question :)

Answer 5

in C# there is appears to be an answer to translating username to SID here http://community.bartdesmet.net/blogs/bart/archive/2006/09/08/4394.aspx but its only for local PCs.

For AD I converted it to:

using System;
using System.DirectoryServices;
using System.Security.Principal;

class Program {
    static void Main(string[] args) {
        string path = "LDAP://" + args[0];
        DirectoryEntry root = new DirectoryEntry(path, args[1], null, AuthenticationTypes.Secure);
        string sid = new SecurityIdentifier((byte[])root.Properties["objectSID"][0], 0).Value;
        Console.WriteLine(sid);
    }
}

The usage is : programname.exe DOMAIN username

e.g. programname.exe somecompany.com preet_sangha