HKEY_USERS\S-1-5-1-xx wich user ?

[organman]

How can I find out wich username corresonds to HKEY_USERS\S-1-5-1-xx ?
I think that S-1-5-18, S-1-5-19, S-1-5-20 belongs to users that exits right after installation of Win XP, such as Administrator, Guest and so on.

But how can I find out wich user HKEY_USERS\S-1-5-1-21 is ?

Is this info somewhere in the registry that I can read ?

Regards
lgnihlman

 

[linney]

Try the "Volatile Environment" value in this registry key.

HKEY_USERS\S-1-5-21-xxxxxxxx-xxxxxxxxx-xxxxxxxx-xxxx\Volatile Environment

It probably is the logged on user?

For more information, see Well-Known Security Identifiers at the Microsoft Resource Kits Web site.

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnc_sid_cids.asp