Quote:

and ofcourse you can check for the loaded user hives.
something like:
for each $key in $HKEY_USERS_KEYS

as only the logged in user's key is loaded.



Hmmm, I'm not familiar with how you check which hive is loaded... Do I compare something in there with a value in HKCU???

Also, how can I tell the difference between an account logged on locally vs a service account (like the one my script is running as)??

Thanks for the suggestions.