Member Avatar for Shaitan00

I have a little situation that I can't seem to resolve and was hoping someone might have some suggestions ...

I have a Windows Service (Serv.exe) which runs under LocalSystem when a user is logged-on (it is only running when users are logged-on), this service is responsible for performing various administrative tasks, one of which is applying registry (.reg) files when needed.

The Services uses REGEDIT (/s /i) to merge in the registry files (.reg) - and this is where things get rough - these registry files related to HKEY_CURRENT_USER (for the user currently logged on) - obviously this causes issues because regedit is being run as a LocalSystem (which is not currently in the HKCU of the user itself) ...

Is there anything I can do?
Can I somehow LINK to the users HKCU so that when I apply the .REG file it updates the users registry?
Can I mirror or reflex the changes somehow?

From where I stand my only solution would be to create my own REG EDIT that would redirect to the logged-on users HKCU (which would be a pain). I've already tried creating a service to mirror HKCU->HKLM but the LocalSystem doesn't seem to have an HKCU at all - so that doesn't help ...

Key point - I do NOT have the username & password of the User account so I cannot use Impersonation... And even there I need admin access to perform my changes.

Any help would be greatly appreciated...
Thanks,

  • 2 Contributors
  • 1 Reply
  • 238 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by angilbert

Dani AI

Generated

Short answer: don’t run RegEdit as LocalSystem to change someone else’s HKCU. Two practical, proven approaches work reliably.

  1. Launch the import under the interactive user’s token. A service running as LocalSystem can obtain the logged-on user’s primary token (for the console/interactive session) and then create a process in that token so RegEdit (or a small helper exe) runs as the user and writes to that user’s HKCU. Use WTSGetActiveConsoleSessionId + WTSQueryUserToken to get the token and CreateProcessAsUser/CreateProcessWithTokenW to start the import process. This avoids parsing .reg files and keeps changes in the real HKCU. (learn.microsoft.com)

  2. Operate on HKEY_USERS\<SID> directly. HKCU is just the current process mapping of a HKEY_USERS subkey, so you can find the logged-in user’s SID and write under HKEY_USERS\<SID>\... via the .NET Registry APIs. If the user is not logged on you can load their hive file (NTUSER.DAT) with RegLoadKey (requires restore/backup privileges) or remap HKCU for a short-lived process with RegOverridePredefKey and then run an importer. Both options let a service perform targeted changes without the user password. (learn.microsoft.com)

Example (simple C# write into an already-loaded hive):

var users = Microsoft.Win32.RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.Users, Microsoft.Win32.RegistryView.Default);
using (var userHive = users.OpenSubKey(sidString, writable: true))
using (var key = userHive.CreateSubKey(@"Software\MyCompany\MyApp"))
{
    key.SetValue("Option", "Value");
}

Practical notes: back up NTUSER.DAT before loading/unloading, test in a VM, and be aware many apps cache HKCU values (they may need a restart or broadcast of settings). ’s WMI idea can work too — a small per-user agent started at logon that accepts commands from your service is a clean, low-friction implementation if you prefer an agent model.

Member Avatar for angilbert

I have a little situation that I can't seem to resolve and was hoping someone might have some suggestions ...

I have a Windows Service (Serv.exe) which runs under LocalSystem when a user is logged-on (it is only running when users are logged-on), this service is responsible for performing various administrative tasks, one of which is applying registry (.reg) files when needed.

The Services uses REGEDIT (/s /i) to merge in the registry files (.reg) - and this is where things get rough - these registry files related to HKEY_CURRENT_USER (for the user currently logged on) - obviously this causes issues because regedit is being run as a LocalSystem (which is not currently in the HKCU of the user itself) ...

Is there anything I can do?
Can I somehow LINK to the users HKCU so that when I apply the .REG file it updates the users registry?
Can I mirror or reflex the changes somehow?

From where I stand my only solution would be to create my own REG EDIT that would redirect to the logged-on users HKCU (which would be a pain). I've already tried creating a service to mirror HKCU->HKLM but the LocalSystem doesn't seem to have an HKCU at all - so that doesn't help ...

Key point - I do NOT have the username & password of the User account so I cannot use Impersonation... And even there I need admin access to perform my changes.

Any help would be greatly appreciated...
Thanks,

I would suggest the possibility of using that Serv.exe to query another application which in turn launches itself as the current user and runs the reg files required as the current user. The other thing you could do is create a WMI C# application that can edit the required settings. This can run as a local application either as a service or as a login script/startup file. Let me know if you would like more information about WMI C# applications as I have created 4 of these to do everything from start/stop/install services, to editing reg keys.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.