1E 23.7 (SaaS)

NativeServices

Core

For each user under HKU, tests whether a given key exists.

Subkey (string): The registry key to look for.

For each user:

Exists (boolean): Whether the key exists or not.

Sid (string): SID of the user.

Username (string): Domain\Username of the aforementioned SID.

 NativeServices.RegistryUserKeyExists(Subkey:"Control Panel\\Colors");

The following statement is a useful way to correlate any user account with its SID on a device.

 NativeServices.RegistryUserKeyExists(Subkey:"");

There is a limit of 8192 values being returned. This limit applies to all users in total, not per user. This is currently not changeable.

If information is retrieved from the .DEFAULT key or a _Classes key, the Username will be reported as "Unknown". It is possible to determine the owner of a _Classes key from the SID that precedes it (which will have a correct Username).