Making changes in HKEY_Users for all users

[duderoo]

I have used a reg app to find a change that it makes to a program I use on a network. Unfortunately it is in HKEY_Users and then the SID ID.

How can I apply this change to all users?

 

[Conradl]

Best option is to use a logon script so that when a user logs on they modify their own HK_Users. Do you currently use logon scripts?

 

[duderoo]

I use logon scripts at the moment that modifies other reg keys, but HK_users is not always the same?

Can you explain?

 

[Conradl]

Sorry about my vague response - should not post before coffee You don't directly modify the HK_Users, but rather the HK_CurrentUser, which is a subset of data from HK_ Users, specific to that particular logged on user. When the user logs on, the script modifies HK_CurrentUser, and the system automatically updates HK_Users....

 

[duderoo]

Ok, we use a certain application and I used a program that when I change something in it, it shows me where the reg key change was and the only change, which I tested, was in HK_user, and nowhere in HKCU?

 

[Conradl]

Exactly! The HK_CurrentUser is dynamically mapped to the correct subset in HK_Users. Think of HK_CurrentUser as a mapped drive: if you write to the drive (or key), it is only committed to the destination, and not the logical link. The HKCU exists to simplfy writing to the users profile without identifying the correct key in HKU.

 

[Conradl]

Best thing is to try for yourself, modify the HKCU with something like "FindMeXXX", search the registry for the string and it will be in HKU.

 

[duderoo]

Surely if I made a change it the app I used should show it up in HKCU as well or is there a way to find the mapping back to HKCU from HKU?

 

[Conradl]

Not sure if I understand your question. The subset of a HKU and HKCU are the same thing for that particular logged on user. The link is Dynamic, so the users subset of HKU = HKCU.

 

[duderoo]

I used an application to track the change I made in outlook and it showed me it was in HKU. I then tested and via the reg it changed the value. How can I now link the reg key change in HKU to HKCU?

When I made the change if HKU is linked to HKCU surely it would have shown the change there as well, the reg change program that is?

 

[Conradl]

Not stumped, was away from my PC at a client Lets start at the beginning:

You need to update a registry key for an application, but you cannot find the user SID to match to the subkey in HKU. When the user logs on, the HKU keyfor that user, is dynamically linked to HKCU. To simplify the script, you need to hard code HKCU\software\***change*** (instead of HKU\SID\Software\***change***).

If I understand you question correctly, you want to know why you only see the change occurring once in Process Monitor, and only on the key that you modify? This is because of the dynamic linking between HKU and HKCU. Try this: Add a string value, to HKCU, with a value of ***FindMe*** (or something that will only occur once in your registry). That change will then reflect in both HKCU and HKU, even though ProcMon only shows one change. If you search HKCU and HKU you will find the updated string.

Take my word for it, I have updated registry setting for literally thousands of users and it works every time