Wednesday, September 08, 2010

Querying HKEY_CURRENT_USER remotely

I'm not sure why MS doesn't allow this to work with their reg.exe program. On most workstations only a single user is logged in anyways...


for /f %%A IN ('type domain-list.txt') DO (
ECHO %%A >> list1.txt
reg query "\\%%A\HKU" > ".\temp.txt"
findstr /R /C:"HKEY_USERS\\S-1-5-21.*[0-9]$" ".\temp.txt" > ".\temp2.txt"
FOR /F %%Z IN ('TYPE .\temp2.txt') DO reg query "\\%%A\%%Z\Software\Unicus Medical Systems" /s /v ReportPrinterName | findstr /R /C:"ReportPrinterName" >> list1.txt
)

The above may have truncated (FYI).

Ok, what this does...
1) Sequentially pull computer names from a file (domain-list.txt)
2) Echo that computer name into our master "list" text file
3) Query the HKEY_USERS via the computer name pulled from step 1 and save to a temporary file
4) Execute a findstr that will only search for user accounts (and not CLASS keys) and save to "temp2.txt".
5) In Temp2.txt, parse and save as variable "%%Z" and execute our reg query and save to our list1.txt file.

You can replace anything with step 5 to do whatever you need (Reg Add/Delete/Query/etc.)

No comments: