how can i know the user name that created the registry key in HKEY_LOCAL_MACHINE

Question

how can i know the user name that created the registry key in HKEY_LOCAL_MACHINE. And how can I get the above username using python? Example:

key :HKEY_LOCAL_MACHINE\BCD00000000\Description
username: BUILTIN\Administrators

Answer 1

You can get the current owner of a key, which may be a group (eg administrators), but not the user that created it. For example, using the PyWin32 package:

import win32security

sd = win32security.GetNamedSecurityInfo(r'MACHINE\BCD00000000\Description',
        win32security.SE_REGISTRY_KEY, win32security.OWNER_SECURITY_INFORMATION)
owner_sid = sd.GetSecurityDescriptorOwner()
owner_name = '\\'.join(win32security.LookupAccountSid(None, owner_sid)[1::-1])

GetNamedSecurityInfo supports local and remote registry keys (eg "\\ComputerName\CLASSES_ROOT\SomePath"), and the predefined registry keys use the following names: "MACHINE", "USERS", "CLASSES_ROOT", and "CURRENT_USER".