Version: 6
restore

Contents

Method

RegistryUserKeyExists

ModuleNativeServices
LibraryCore
Action

Checks whether a given key exists for every user under HKU.

ParametersSubkey (string): The registry key to look for.
Return values

For each user:

Exists (boolean): True if the key exists, false if it doesn't.

Sid (string): SID of the user.

Username (string): Domain\Username of the aforementioned SID.

Example
 NativeServices.RegistryUserKeyExists(Subkey:"Console\\%SystemRoot%_System32_cmd.exe");
Platforms
  • Windows
Notes

 

There is a limit of 8192 values being returned. This limit applies to all users in total, not per user. This is currently not changeable.

If information is retrieved from the .DEFAULT key or a _Classes key, the Username will be reported as "Unknown". It is possible to determine the owner of a _Classes key from the SID that precedes it (which will have a correct Username).

Warning

This method may attempt to call AD to translate a SID to a username.