Improved Hkey targeting

This commit is contained in:
poslop
2026-01-14 09:16:20 -06:00
parent 90a27b5a8f
commit fe7185d593

View File

@@ -1,31 +1,45 @@
$profileListKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'
$sids = Get-ChildItem $profileListKey |
Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' }
$sids = Get-ChildItem $profileListKey
$printerPaths = @(
'\Printers\Connections',
'\Printers\ConvertUserDevModesCount',
'\Software\Xerox\PrinterDriver',
'\Software\Microsoft\Windows NT\CurrentVersion\Devices'
)
$HKLMPrinterPaths = @(
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers',
'HKEY_LOCAL_MACHINE\SOFTWARE\Xerox\PrinterDriver'
)
foreach ($printerPath in $HKLMPrinterPaths) {
try {
Remove-Item -Path "Registry::$printerPath" -Recurse -Force -ErrorAction Stop
} catch {
Write-Host "Error: $($_.Exception.Message)"
}
}
foreach ($sidKey in $sids) {
$sid = $sidKey.PSChildName
$profilePath = (Get-ItemProperty -Path $sidKey.PSPath -Name ProfileImagePath).ProfileImagePath
if (-not $profilePath) { continue }
$ntUserDat = Join-Path $profilePath 'NTUSER.DAT'
if (-not (Test-Path $ntUserDat)) { continue }
$mounted = $false
foreach ($printerPath in $printerPaths) {
try {
if (Test-Path "Registry::HKEY_USERS\$sid") { $mounted = $true }
} catch { $mounted = $false }
if (-not $mounted) {
$loadResult = & reg.exe load "HKU\$sid" "$ntUserDat" 2>&1
Remove-Item -Path "Registry::HKEY_USERS\$sid$printerPath" -Recurse -Force -ErrorAction Stop
} catch {
Write-Host "Error: $($_.Exception.Message)"
}
}
try {
Remove-Item -Path "Registry::HKEY_USERS\$sid\Printers" -Recurse -Force -ErrorAction Stop
} catch {}
if (-not $mounted) {
$unloadResult = & reg.exe unload "HKU\$sid" 2>&1
}
}
gpupdate /force