Getting full registry key path from value with powershell

Question

So I know, what value I am looking for, but I don't know the full path to that value, since its in

"HKLM\\software\\microsoft\\windows nt\\currentversion\\profilelist" , so user/profile ID?

So lets say I take a user called "computer_user_01" . That means, that his "ProfileImagePath" is "C:\\users\\computer_user_01" .

So lets say the full path to that value is:

`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3548956479-1181130828-1993911463-1001\ProfileImagePath\C:\users\computer_user_01".

So I need the S-1-5-21-3548956479-1181130828-1993911463-1001\\ .

How can I get it from the ProfileImagePath key, C:\\Users\\computer_user_01 value ?

Right now I can query the ProfileImagePath key, but it gives me all users:

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath" 

How can I specify it further, lets say this worked:

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath" -Value "C:\users\computer_user_01" 

Hope you can understand.

Answer 1

You can try the following :

# First I get the SID    
$sid = (gwmi win32_useraccount | ? {$_.name -eq "computer_user_01"}).SID
# Then the value of the property you look for
(Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid\"   -Name "ProfileImagePath")

Answer 2

Ok you used Get-ItemProperty -Path "hklm:\\software\\microsoft\\windows nt\\currentversion\\profilelist\\*\\" , each Object returned has an attribute ProfileImagePath and PSChildName , which hold everything you need.

Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" | ? {$_.ProfileImagePath -eq "C:\users\computer_user_01"} | Select-Object -ExpandProperty PSChildName

Returns the wanted S-1-5-21-3548956479-1181130828-1993911463-1001

Explanation:

? {$_.ProfileImagePath -eq "C:\\users\\computer_user_01"} ? {$_.ProfileImagePath -eq "C:\\users\\computer_user_01"} - Find the Object with the ProfileImagePath of you Path

Select-Object -ExpandProperty PSChildName - Output the name of the Object-Adult

Answer 3

You could do:

(Get-ItemProperty -Path "hklm:\software\microsoft\windows nt\currentversion\profilelist\*\" -Name "ProfileImagePath" | 
 Where-Object { $_.ProfileImagePath -eq 'C:\users\computer_user_01' }).PSChildName