Changes to registry load/unload

This commit is contained in:
2023-11-06 13:07:47 +01:00
parent eb37173e1a
commit bd7ffb685b

View File

@@ -9,7 +9,11 @@ function UserReg {
if ($null -ne $UserProfile) {
$UserSID = $UserProfile.SID
if( -not (Test-Path -Path "Registry::HKEY_USERS\$UserSID" -PathType Container) ) {
REG LOAD HKEY_USERS\$UserSID "C:\Users\$Username\NTUSER.DAT"
$res = REG LOAD HKEY_USERS\$UserSID "C:\Users\$Username\NTUSER.DAT"
if ($res -ne 0) {
Write-Host "Failed to load $Username's HKU registry hive."
return $null, $null
}
}
Write-Host "Loaded $Username's HKU registry hive."
return $UserSID, "Registry::HKEY_USERS\$UserSID"
@@ -80,9 +84,9 @@ function SetupEleveReg {
foreach ($valueName in $applications) {
New-ItemProperty -Path $DisallowRunPath -Name $valueName -Value $valueName -PropertyType String
}
Write-Host "Added entries to DisallowRun for cmd.exe and powershell.exe."
Write-Host "Added registry entries"
Write-Host "Unloading registry HIVE"
REG UNLOAD HKEY_USERS\$UserSID
Start-Process -FilePath "cmd.exe" -Verb RunAs -ArgumentList "REG UNLOAD HKEY_USERS\$UserSID"
} else {
Write-Host "Unable to get the user's HKU registry."
}