8 Replies Latest reply on May 31, 2018 10:52 AM by phoffmann

    Registry key profileList

    garcel1 Apprentice

      Hello

       

      Do you  know if is possible to  collect the profilelist (regedit) from a client  through inventory scan  .

       

       

       

        • 1. Re: Registry key profileList
          carlos Expert

          Yes, you do it via custom data.

          Custom Data: Registry Search

          • 2. Re: Registry key profileList
            phoffmann SupportEmployee

            As per Carlos' comment, the short answer is - yes - "you can".

             

            The longer answer is "you may need to be careful if you deal with 1:* data".

             

            If you're just looking for a SINGLE data point (i.e. "C:\Users\" for instance), then this is easy enough to do (whether by script, or poking a specific registry key, etc).

             

            If you're looking for MULTIPLE data points (i.e. "User Bob" is in "C:\Users", but "User Bill" is in "C:\SomewhereElse\"), this would be 1:* (one-to-many) data, which *CAN* still be collected, it just needs to go into modelled DB-tables (as so happens, I've held a session on just this topic at Interchange in Dallas, and the white paper involved is currently being reviewed. It's a bit long though, so will need some time to get the relevant legal sign-off before I can publish it).

             

            As a up-front note, you can keep an eye on the following -- HOW TO: Creating / modelling your own custom DB-tables -- as that'll be the location where It'll be published once it's all approved & what-not (NOTE - you won't be able to access the place-holder article at present, nor does it have the draft white paper uploaded as yet).

            • 3. Re: Registry key profileList
              garcel1 Apprentice

              Thank you for the info.

               

              I  tried to do a test but  I found some obstacles :

              1.- The  profilelist has some entries  and each entry has a different data in ProfileImagePath field that I need and every machine has different entries into the Profile list :

               

               

              How it would be the key  in order to get those  data:

              if I put "\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList"  I only get below data :

               

               

              But I want to get the data from "ProfileImagePath"  for each entry.

               

              How can I do ?

               

              Thank you for advance

              • 4. Re: Registry key profileList
                carlos Expert

                Is that key the same in all installs? the one ending in 2400?

                If not it's my understanding you can do a foreach loop but unfortunately I do not know how to do that (without googling it), I'll leave that to the MASTERS.

                • 5. Re: Registry key profileList
                  garcel1 Apprentice

                  Hello Carlos

                   

                  The key is not the same .

                  • 6. Re: Registry key profileList
                    carlos Expert

                    Check Phoffmann answer above, you could check if something here helps you search registry foreach loop - Bing

                    Just thinking here, you could run a script that finds the key for you and saves it into a define entry. I don't know...

                     

                    Good luck!

                    • 7. Re: Registry key profileList
                      phoffmann SupportEmployee

                      OK - so it sounds like you'll need to store it as 1:* data on the DB-end one way or another.

                       

                      What you can do in the meantime is figure out a script to access the regsitry & get the stuff you want ... that's something you'll need to do anyawy.

                       

                      Hopefully my white paper will be proof-read & accepted soon, then I can point you at the DB-side stuff & we can figure out the "how to get that stuff added to your inventory scan" which should be easier in comparison.

                       

                      NOTE -- from personal experience, if you're using PowerShell (as I usually default nowadays), be aware that it does some WEIRD stuff when accessing Registry. Be prepared for shenanigans ... it hit me up a few ways with WTF moments when I looked at it ... a colleague just switched over to accessing the registry via VB instead as he ran into similar issues.

                       

                      So - whatever poison you use to hit up the registry, be (painfully) aware that it can be "a magical place", and sadly not in the good sense.

                      • 8. Re: Registry key profileList
                        phoffmann SupportEmployee

                        As a separate thought -- one part of the script I'd suggest is "poking your AD" to resolve those SID's.

                         

                        Having to query for SID-s as part of inventory is going to be horrible - much better to have a "Joe Sixpack" name or a "JSixpack" username instead of an arcane "S-1-5-15-123-123-123-123" type value that's not human friendly at all .