Registry of pupil user type

[the_quick]

Hi,

 

Can anybody point me to direction how I can get registry key hkey current user for pupil.

Of course if pupil is logged in I cannot run regedit, as this is disables, together with Run option in start menu. Remote registry view does not help as you can see only local machine registry, but not currently logged user. And I need to check if some setting are applied or not.

 

Anyone has any ideas?

 

CC3 workstation

 

Thanks

[K.C.Leblanc]

Take a copy of the profile.

 

And then use regedit's load hive function to have a look at it.

[soveryapt]

Can you not use "runas" to run regedit as a user with permissions? (you could easily put it into a bat file).

 

@echo off

::Basic Run As Script for RegEdit
runas /user:DOMAIN\Administrator "regedit"

 

When you run that BAT file you should then get a CMD Prompt asking for the password for the chosen admin account, and if all the credentials match up, regedit will fire up with those permissions.

 

If you have access to CMD on the pupil login, you could just type the line:

 

runas /user:DOMAIN\Administrator "regedit"

 

Hope that helps

Andy

[the_quick]

Thanks both for input

K.C. Leblanc - I will try with the profile,

 

Andy - we made sure that students can't run scripts, they don't have Run option in start menu, they don't have option under right click Runs as.., they do not access to view files on C drive. So it is very limited what students can do - and we want to keep that way

[soveryapt]

Thanks both for input

K.C. Leblanc - I will try with the profile,

 

Andy - we made sure that students can't run scripts, they don't have Run option in start menu, they don't have option under right click Runs as.., they do not access to view files on C drive. So it is very limited what students can do - and we want to keep that way

 

I fully understand! Was worth a shot though!

[LiamH]

You could use policy killer to remove the GPO effecting run/regedit

 

And as K.C. Leblanc said the ntuser.dat contains the user registry, so load that via regedit to see it