#187539 - 2008-05-09 02:14 PM
Re: NTUSER.DAT
[Re: NTDOC]
|
BradV
Seasoned Scripter
  
Registered: 2006-08-16
Posts: 687
Loc: Maryland, USA
|
You can just mount it to a temporary location such as:
$intSelect = LoadHive("HKEY_USERS\Temp","\\path\to\desired\ntuser.dat")
If $intSelect = 0
; Get printer info.
$strDefP = ReadValue("HKEY_USERS\Temp\Software\Microsoft\Windows NT\CurrentVersion\Windows", "Device")
$strDefP = Substr($strDefP,1,Instr($strDefP,",")-1)
$intErr = WriteProfileString($strFile,"Printers","Default",$strDefP)
$intSelect = 0
$intIndex2 = 0
$strKey = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
While @Error = 0
ReDim Preserve $arrMap[1,$intIndex2]
$temp = Split($strKey,","4)
$arrMap[0, $intIndex2] = $temp[2]
$arrMap[1, $intIndex2] = $temp[3]
$intErr = WriteProfileString($strFile,"Printers",$arrMap[0, $intIndex2],$arrMap[1, $intIndex2])
$intIndex2 = $intIndex2 + 1
$intSelect = $intSelect + 1
$strKey = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
Loop
$intSelect = UnLoadHive("HKEY_USERS\Temp")
If $intSelect <> 0
? "Open regedit and check HKEY_USERS\Temp. It was not unloaded."
EndIf
Else
? "Could not load the hive, ..."
EndIf
Note that it probably won't work if it is in use. I think you can make a copy first and then load it.
I just saw that you were trying to retrieve printer info. I wrote a script to do that (among other things). I've added that in here. I had to re-type. So, I hope I didn't make any typos! 
Regards,
Brad V
Edited by BradV (2008-05-09 02:27 PM)
|
|
Top
|
|
|
|
#187569 - 2008-05-12 03:13 PM
Re: NTUSER.DAT
[Re: Gargoyle]
|
BradV
Seasoned Scripter
  
Registered: 2006-08-16
Posts: 687
Loc: Maryland, USA
|
This is part of a larger script I wrote for getting information out of ntuser.dat after it has been corrupted. The usual method of fixing here is to move the current personal folder to a different name and create a new one. So, we usually wind up with several old ntuser.dat files laying around. I first go into their home directory and search for all ntuser.dat files. I then present this list and query which one to examine. The script then mounts that ntuser.dat file and pulls out as much information as possible. I read drive mappings, printers, color schemes, wall paper, screen saver among others.
Usually I can find whatever is needed. Quite often one of the other admins would just create a blank new ntuser.dat file for the person and would leave. If I get called in later and the customer says, "I can't find my G drive." I could ask "What was G mapped to?" and would usually just get, "I don't know. It was my G drive!" So, I just run my script and look next oldest ntuser.dat file beyond the current one and see if the G drive is mapped there, etc.
Regards,
Brad V
|
|
Top
|
|
|
|
#187598 - 2008-05-13 01:36 PM
Re: NTUSER.DAT
[Re: NTDOC]
|
BradV
Seasoned Scripter
  
Registered: 2006-08-16
Posts: 687
Loc: Maryland, USA
|
Hi Doc,
I think most of the corruption happens because users with a w2k profile wind up logging in to xp computers and vice-versa. Now they are talking about trying to put Vista into the mix! 
Regards,
Brad V
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|