Registry HKEY_CURRENT_USER / HKEY_USERS

[ojf]

I have a Win XP pro machine where I am the administrator. I have 5 more users with limited accounts, and one user who will normally log on remotely. I have disabled all drives for this user, except the D: drive using the key NoDrives / NoViewOnDrive in her HKEY_CURRENT_USER area.

It irritates me that I do not see her HKEY_USERS area in the registry. When I log in as her I find that the string to her area is HKEY_USERS\S-1-5-21-1993962763-436374069-725345543-1014, but I do not find this when I log on as myself. However, if I leave her logged on (by switching user) and log on as myself, I see her HKEY_USERS area.

Is there a key that can be set, so that administrators or just me, can see all the the HKEY_USERS? - Or do you know about a program that will do so?

 

[bcastner]

A SID that begins S-1-5-2 indicates a network logon, and not a local console logon.

No access token contains both S-1-2-0 (Local) and S-1-5-2 (Network); the two groups are mutually exclusive. See:

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnc_sid_cids.asp

There is no registry hive HKEY_USERS. This is built from the DEFAULT and (in part) the SAM hives and the user NTUSER.DAT files. For any currently logged in users, the HKEY_CURRENT_USER registry representation is then built at logon. The representation in regedit is essentially a virtual view of the five underlying physical hives + NTUSER.DAT.