[python-win32] HKLM\SOFTWARE\...\ProfileList\... registry subkey query

[Tim Roberts]

raf wrote:
> ages ago i wrote some code to get a user's home directory on windows
> (even if they'd gone into the registry and moved it). i remember it
> working when i wrote it but at some point it stopped working. when i
> looked into it, it turned out that the registry subkeys no longer
> looked like what the code was expecting.
> ...
> given the account sid:
>
>   S-1-5-5-21-725345543-1957994488-859522115

That's not an account SID, that's a logon session (S-1-5-5).  Did you
perhaps copy-and-paste this by typing it by hand?  If you eliminate the
extra -5 (so, S-1-5-21-xxx), then it would be a domain SID.  It's still
not a user account SID -- that requires one more set of digits, as you
found below.


> however, instead of the above registry key, there are:
>
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1003
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1004
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1005
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1006
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1008
>   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-5-21-725345543-1957994488-859522115-1009
>
> each referring to a different user (patricia happens to be the one ending in 1009).

Right.  Those are user accounts within the domain or local group
S-1-5-21-...-859522115.

-- 
Tim Roberts, timr at probo.com
Providenza & Boekelheide, Inc.