How to access HKCU registry of currently logged on user(s), from a service?

Question

From within a windows service I want to check some user preferences that are stored within each users' HKCU registry area. How can I do this?

I see that HKEY_USERS has subkeys of each user that has logged in to the machine (or something like that?), and within these are the HKCU areas for each user. However, these subkeys are the SIDs of the users, so somehow I'd need to work out the SID of the currently logged in user(s).

I would then query HKEY_USERS\<the users SID>\whichever\key\i\need in place of querying HKEY_CURRENT_USER\whichever\key\i\need.

From this question I can get a list of the current users on the machine in DOMAIN\USER format. Is there a way to get the SID of a user from their windows login? Or is there a more direct way to get the registry path that is HKCU for the currently logged in user(s)?

Answer 1

In order to do this you will need to do one of the following

1. Impersonate the users credentials and access HKCU from that impersonation context
2. Read the registry file directly off of disk (this has threading and data integrity implications).

I'm not 100% sure that #1 will work but I believe it will.

For either solution though you will need either the users credentials or access token in your process. This is not easily available because it's a security issue.

Answer 2

Here's an example of converting a username to SID: http://stackoverflow.com/questions/1040623/convert-a-username-to-a-sid-string-in-c-net

Answer 3

You can connect to their remote registry, then search the entire HKU key for their username (i.e. jsmith). Various entries reference their user profile; these will pop up then you can just look under which SID those entries are located. Bit of a roundabout way of doing it, but seems to work.