This is part of a larger script I wrote for getting information out of ntuser.dat after it has been corrupted. The usual method of fixing here is to move the current personal folder to a different name and create a new one. So, we usually wind up with several old ntuser.dat files laying around. I first go into their home directory and search for all ntuser.dat files. I then present this list and query which one to examine. The script then mounts that ntuser.dat file and pulls out as much information as possible. I read drive mappings, printers, color schemes, wall paper, screen saver among others.

Usually I can find whatever is needed. Quite often one of the other admins would just create a blank new ntuser.dat file for the person and would leave. If I get called in later and the customer says, "I can't find my G drive." I could ask "What was G mapped to?" and would usually just get, "I don't know. It was my G drive!" So, I just run my script and look next oldest ntuser.dat file beyond the current one and see if the G drive is mapped there, etc.

Regards,

Brad V