How to Find Users HKEY_USERS Registry Key Using PowerShell

Registry keys are items on PowerShell drives like folders. They contain registry entries and their associated values instead of files.

The Windows operating system has two registry key types: HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. The first one contains the keys and values related to the user, and the other one contains the OS-related information, such as the services, drivers, and programs loaded on startup.

This tutorial will teach you to find a user’s HKEY_USERS registry key using PowerShell.

Use Get-ChildItem Cmdlet to Find Users HKEY_USERS Registry Key Using PowerShell

The HKEY_USERS contains all the actively loaded user profiles on the computer. You can use the Get-PSDrive cmdlet to get the path of the registry key hives on your computer.

Get-PSDrive

Output:

Name           Used (GB)     Free (GB) Provider      Root                CurrentLocation
----           ---------     --------- --------      ----                ---------------
Alias                                  Alias
C                 368.92         87.07 FileSystem    C:\                 Users\rhntm
Cert                                   Certificate   \
Env                                    Environment
Function                               Function
HKCU                                   Registry      HKEY_CURRENT_USER
HKLM                                   Registry      HKEY_LOCAL_MACHINE
Variable                               Variable
WSMan                                  WSMan

The HKEY_CURRENT_USER contains the root of the configuration information for the currently logged-in user. The user’s folders and Control Panel settings are also stored in it.

The HKEY_LOCAL_MACHINE contains configuration information of the computer. It stores the user profiles of any user on the computer.

The following script returns the registry key of a user whose username is rhntm or matches the value in ProfileImagePath. The ProfileImagePath contains the user’s home directory path, like C:\Users\rhntm.

Get-ChildItem 'HKLM:Software/Microsoft/Windows NT/CurrentVersion/ProfileList' | ? {
    $_.getvalue('ProfileImagePath') -match 'rhntm' } | % PSChildName

Output:

S-1-5-21-1715350875-4262369108-2050631134-1001

You can easily get a user’s registry key in HKEY_USERS if you have that user’s login name. We hope this article helped us understand how to find a user’s registry key using PowerShell.