如何映射 HKEY_USERS 子项和 Windows 用户名？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1029264/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to map HKEY_USERS subkeys and Windows usernames?
提问by JCCyC
I thought the key names immediately below HKEY_USERS were supposed to be the usernames of whoever logged in at this machine at some time. But in my machine what appears is:
我认为 HKEY_USERS 正下方的键名应该是某个时间登录这台机器的人的用户名。但在我的机器上出现的是：
S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN
S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN_Classes
I'd like to be able to determine which subtree corresponds to which user. How can I do that?
我希望能够确定哪个子树对应于哪个用户。我怎样才能做到这一点？
Edit: WHat I need is to get the usernames from the SIDs. I want to inspect the configurations of each user that has ever logged on, and I need to know their names. For example, in the registry above, I need to be able to, based on the string "S-1-5-21-NNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN", find out that it correspond to DOMAIN\somebody, or LOCALMACHINENAME\somebodyelse.
编辑：我需要的是从 SID 获取用户名。我想检查每个曾经登录过的用户的配置，我需要知道他们的名字。例如，在上面的注册表中，我需要能够根据字符串“S-1-5-21-NNNNNNNNNN-NNNNNNNNN-NNNNNNNNNN-NNNNN”，找出它对应的是DOMAIN\somebody，或者LOCALMACHINENAME\其他人。
回答by dcharles
It is possible to query this information from WMI. The following command will output a table with a row for every user along with the SID for each user.
可以从WMI查询此信息。以下命令将输出一个表，其中每个用户都有一行以及每个用户的 SID。
wmic useraccount get name,sid
You can also export this information to CSV:
您还可以将此信息导出为 CSV：
wmic useraccount get name,sid /format:csv > output.csv
I have used this on Vista and 7 (according to the comments it works on 2008 R2 as well). For more information see WMIC - Take Command-line Control over WMI.
我在 Vista 和 7 上使用过它（根据评论它也适用于 2008 R2）。有关详细信息，请参阅WMIC - 对 WMI 进行命令行控制。
回答by steamer25
I believe those numbers are the user's security ID (SID). You can use SysInternals to get the SIDs of users:
我相信这些数字是用户的安全 ID (SID)。您可以使用 SysInternals 来获取用户的 SID：
http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx
http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx
回答by Ashley McGlone - GoateePFE
For PowerShell this is quick:
对于 PowerShell，这很快：
gwmi win32_userprofile | ft localpath, sid
Ashley McGlone Microsoft PFE http://aka.ms/GoateePFE
Ashley McGlone 微软 PFE http://aka.ms/GoateePFE
回答by Cooper
HKLM\System\CurrentControlSet\Control\hivelist will show you where the hives are mounted from. While not a direct mapping, usually the mount point has the user name in the path.
HKLM\System\CurrentControlSet\Control\hivelist 将显示配置单元的安装位置。虽然不是直接映射，但挂载点通常在路径中包含用户名。
I'm sure there is a better answer than this though...
我敢肯定还有比这更好的答案...
回答by mihi
When doing it manually (without extra tools), the easiest way is to open permissions for that key. The only user who has full permissions is the owner of the key.
手动执行（无需额外工具）时，最简单的方法是打开该密钥的权限。唯一拥有完全权限的用户是密钥的所有者。
When from a program, you will need a way to convert SIDs to account names. In C# (or PowerShell), have a look at the SecurityIdentifier and NtAccount class for that.
从程序中时，您需要一种将 SID 转换为帐户名称的方法。在 C#（或 PowerShell）中，查看 SecurityIdentifier 和 NtAccount 类。
回答by Preet Sangha
in C# there is appears to be an answer to translating username to SID here http://community.bartdesmet.net/blogs/bart/archive/2006/09/08/4394.aspxbut its only for local PCs.
在 C# 中似乎有一个将用户名转换为 SID 的答案http://community.bartdesmet.net/blogs/bart/archive/2006/09/08/4394.aspx但它仅适用于本地 PC。
For AD I converted it to:
对于 AD，我将其转换为：
using System;
using System.DirectoryServices;
using System.Security.Principal;
class Program {
static void Main(string[] args) {
string path = "LDAP://" + args[0];
DirectoryEntry root = new DirectoryEntry(path, args[1], null, AuthenticationTypes.Secure);
string sid = new SecurityIdentifier((byte[])root.Properties["objectSID"][0], 0).Value;
Console.WriteLine(sid);
}
}
The usage is : programname.exe DOMAIN username
用法是：programname.exe DOMAIN 用户名
e.g. programname.exe somecompany.com preet_sangha
例如 programname.exe somecompany.com preet_sangha
回答by amuliar
Please use powershell:
请使用powershell：
$mydocuments = [Environment]::GetFolderPath("mydocuments")
gwmi win32_userprofile | ft localpath, sid, status -AutoSize | Out-File $mydocuments\userprofiles.txt
