Setting Values for HKCU but not Default User Hive

Topics: Archive - General
Dec 5, 2014 at 3:29 AM
I've got a tweak I need to make to all user hives, but I don't necessarily want it to apply to the default users hive.

My first thought was just to use the first user in the array from the Get-UserProfiles Function:

[scriptblock]$HKCURegistrySettings = {
Remove-RegistryKey -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name 'AutoConfigURL' -SID $UserProfile.SID
}
Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings -UserProfiles (Get-UserProfiles)[0]

But this would only work if there is only one user on the machine, this might not always be the case.

Is there any built in function to only do Users and not the Default hive?
Developer
Dec 5, 2014 at 6:15 AM
Edited Dec 5, 2014 at 6:17 AM
Yes, there is a parameter in Get-UserProfiles for excluding user profiles of your choice. You can feed it an array of profiles to exclude if you have more than one that needs to be excluded. Use the below call in your case to get the result you want. Note that I just made up the name for the default user in the function, so that we could do things with it, as it's not really a true user on the machine. Hopefully we never run into a case of someone actually naming a real account "Default User"...
Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings -UserProfiles (Get-UserProfiles -ExcludeNTAccount 'Default User')
Dec 5, 2014 at 1:45 PM
Thanks for that quick response, but perhaps I'm reading it wrong? I added the -ExcludeNTAccount param with the 'Default User' value, and it still returns the default user's hive:
[Post-Uninstallation] :: Get the User Profile Path, User Account SID, and the User Account Name for all users that log onto the machine.    Get-UserProfiles    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Convert the SID [S-1-5-18] to an NT Account name.  ConvertTo-NTAccountOrSID    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Convert the SID [S-1-5-19] to an NT Account name.  ConvertTo-NTAccountOrSID    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Convert the SID [S-1-5-20] to an NT Account name.  ConvertTo-NTAccountOrSID    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Convert the SID [S-1-5-21-2726843942-119376125-95398301-1000] to an NT Account name.   ConvertTo-NTAccountOrSID    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: The User [WIN-T0K0HP9UM6M\josh] registry hive is already loaded in path [HKEY_USERS\S-1-5-21-2726843942-119376125-95398301-1000]   Invoke-HKCURegistrySettingsForAllUsers  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Execute ScriptBlock to modify HKCU registry settings for all users.    Invoke-HKCURegistrySettingsForAllUsers  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Return fully qualified registry key path [Registry::HKEY_USERS\S-1-5-21-2726843942-119376125-95398301-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings]    Convert-RegistryPath    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Delete registry value [Registry::HKEY_USERS\S-1-5-21-2726843942-119376125-95398301-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings] [AutoConfigURL]   Remove-RegistryKey  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Load the User [Default User] registry hive in path [HKEY_USERS\S-1-5-21-Default-User]  Invoke-HKCURegistrySettingsForAllUsers  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Execute ScriptBlock to modify HKCU registry settings for all users.    Invoke-HKCURegistrySettingsForAllUsers  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Return fully qualified registry key path [Registry::HKEY_USERS\S-1-5-21-Default-User\Software\Microsoft\Windows\CurrentVersion\Internet Settings]  Convert-RegistryPath    12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Delete registry value [Registry::HKEY_USERS\S-1-5-21-Default-User\Software\Microsoft\Windows\CurrentVersion\Internet Settings] [AutoConfigURL] Remove-RegistryKey  12/5/2014 8:27:16 AM    1 (0x0001)
[Post-Uninstallation] :: Unload the User [Default User] registry hive in path [HKEY_USERS\S-1-5-21-Default-User]    Invoke-HKCURegistrySettingsForAllUsers  12/5/2014 8:27:16 AM    1 (0x0001)
Did I type something wrong in the parameter?
Developer
Dec 5, 2014 at 2:00 PM
:), there is a bug in the function. I will get it resolved today and let you know when it's fixed.
Developer
Dec 5, 2014 at 2:57 PM
So I added the ability to exclude the Default User to the function. You can find the update in the beta under the "Source Code" tab of this site. You will have to call the function like so once you have the update:
Invoke-HKCURegistrySettingsForAllUsers -RegistrySettings $HKCURegistrySettings -UserProfiles (Get-UserProfiles -ExcludeDefaultUser)
Let me know if it works OK for you.
Marked as answer by therealjoshuad on 12/14/2014 at 8:52 PM
Dec 5, 2014 at 3:56 PM
That worked. I ran the code, then logged in as a new user, and it was not part of their profile. Thanks for the help with this tool, and thanks for all that you guys do w/ the Toolkit.