;NAME          ntuser.kx
;
;DESCRIPTION   This is a script to find an old ntuser.dat file
; for a given user and search it for printer and drive mappings.
;
;AUTHOR	Brad Van Orden
;
;VERSION	1.0
;
;HISTORY	Created 25 Apr 07
;		30 Apr 07 - Added in file time to display.
;               1  May 07 - Finished enumerating and reading mapped network drives.
;			    Added printer connections.
;		15 May 07 - Added in color scheme and screen saver information.
;		17 May 07 - Added in some error handling for not finding an ntuser.dat file.
;               8  Jun 07 - Added some more screen saver selections.
;                           Added some code to write all of the information to a text file.
;
Break On
;
Dim $SO
;
; These are just programming options for me.
; One forces me to define all variables and the
; other doesn't allow a kixtart macro within a string.
;
$SO = SetOption('Explicit',          'On')
$SO = SetOption('NoMacrosInStrings', 'On')
;
DIM $objUser, $strUser, $strDomain, $strHomeD, $strDAT, $temp
DIM $arrDAT[0,0], $intIndex, $intCounter, $strMesg, $intSelect
DIM $strKey, $intIndex2, $arrMap[1,0], $strDefP, $intDAT, $strClrSchm
DIM $strWallP, $arrTemp, $strScrnSName, $strProfD
DIM $strMQText, $strMQAtt, $strMQBC, $strMQCS, $strMQFont, $strMQMode, $strMQSz
DIM $strMQSpd, $strMQTextC, $strFile
DIM $arrScrn[1,0], $intI, $intErr, $strTemp
;
$strDomain = @LDOMAIN
;
While $strUser == ""
   ? "Please enter the login ID of the person:"
   Gets $strUser
Loop
;
$objUser = GetObject("WinNT://" + $strDomain + "/" + $strUser + ",user")
If @ERROR <> 0
   ? "Could not find the user in active directory, " + $strUser
   exit 1
EndIf
;
$strHomeD = $objUser.HomeDirectory
$strProfD = $strHomeD + "\_sys"
;
$arrDAT   = FSearch($strProfD,"ntuser.dat")
If @ERROR = 2
   ? "Could not find an ntuser.dat file for this user."
   exit 2
EndIf
;
$intIndex = Ubound($arrDat,2)
$strMesg  = ""
For $intCounter = 0 to $intIndex
   If $strMesg = ""
      $strMesg = "Count" + Chr(9) + "Path" + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + "FileName" + Chr(9) + Chr(9) + "Date"
   EndIf
   $strMesg = $strMesg + Chr(13) + $intCounter + Chr(9) + $arrDat[0,$intCounter] + Chr(9) + $arrDat[1,$intCounter] + Chr(9) + $arrDat[2,$intCounter]
Next
;
$intSelect = MessageBox($strMesg,"Click on OK and Make a Selection at the Command Prompt",4144)
$intDAT = -1
While $intDAT < 0 or $intDat > $intIndex
   ? "Enter your selection: "
   Gets $intDAT
Loop
? "You selected, " + $intDAT
;
; Now read the data from the ntuser.dat file.
$intSelect = LoadHive("HKEY_USERS\Temp", $arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT])
If $intSelect = 0
   ; Start writing the data to a file.
   $strFile = "C:\Documents and Settings\" + @userid + "\Desktop\" + $strUser + "_profdat.ini"
   $intErr  = WriteProfileString($strFile,"Home Path","homed",$strHomeD)
   ? "Home directory is: " + $strHomeD
   $intErr  = WriteProfileString($strFile,"Path Searched","HKU",$arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT])
   ? "ntuser.dat file examined is: " + $arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT]
   ;
   ; Hive is loaded, now read the data.  This section will retrieve persistent drive mappings.
   $intSelect = 0
   $intIndex2 = 0
   $strKey    = EnumKey("HKEY_USERS\Temp\Network", $intSelect)
   While @Error = 0
      ReDim Preserve $arrMap[1,$intIndex2]
      ? "Found key: " + $strKey
      $arrMap[0, $intIndex2] = $strKey
      $arrMap[1, $intIndex2] = ReadValue("HKEY_USERS\Temp\Network\" + $strKey, "RemotePath")
      ? "Remote Path = " + $arrMap[1, $intIndex2]
      $intErr                = WriteProfileString($strFile,"Persistent Connections",$arrMap[0, $intIndex2],$arrMap[1, $intIndex2])
      $intIndex2             = $intIndex2 + 1
      $intSelect             = $intSelect + 1
      $strKey                = EnumKey("HKEY_USERS\Temp\Network", $intSelect)
   Loop
   ;
   ; Next, read printer information
   ; The default printer is found at HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
   ;
   $strDefP = ReadValue("HKEY_USERS\Temp\Software\Microsoft\Windows NT\CurrentVersion\Windows","Device")
   $strDefP = Substr($strDefP,1,Instr($strDefP,",")-1)
   ? "The default printer is: " + $strDefP
   $intErr  = WriteProfileString($strFile,"Printers","Default",$strDefP)
   ;
   ; Now get all of the mapped printers.
   ;
   $intSelect = 0
   $strKey    = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
   While @Error = 0
      ReDim Preserve $arrMap[1,$intIndex2]
      $temp                  = Split($strKey,",",4)
      $arrMap[0, $intIndex2] = $temp[2]
      $arrMap[1, $intIndex2] = $temp[3]
      ? "Found printer, " + $arrMap[1, $intIndex2] + ", through server, " + $arrMap[0, $intIndex2]
      $intErr                = WriteProfileString($strFile,"Printers",$arrMap[0, $intIndex2],$arrMap[1, $intIndex2])
      $intIndex2             = $intIndex2 + 1
      $intSelect             = $intSelect + 1
      $strKey                = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
   Loop
   ;
   ; Now check color scheme
   $strClrSchm = ReadValue("HKEY_USERS\Temp\Control Panel\Current","Color Schemes")
   If @ERROR = 0
      ? "Color scheme is set to: " + $strClrSchm
   Else
      ? "Could not read the color scheme.  Will set it to Windows Standard."
      $strClrSchm = "Windows Standard"
   EndIf
   $intErr = WriteProfileString($strFile,"Desktop","Scheme",$strClrSchm)
   ;
   ; Check wallpaper
   ;
   $strWallP = ReadValue("HKEY_USERS\Temp\Control Panel\Desktop","Wallpaper")
   If @ERROR = 0
      If $strWallP <> ""
         ? "Customer's wallpaper is set to: " + $strWallP
         $intErr = WriteProfileString($strFile,"Desktop","paper",$strWallP)
      Else
         ? "Customer does not have any wallpaper set."
         $intErr = WriteProfileString($strFile,"Desktop","paper","none")
      EndIf
   Else
      ? "Had trouble reading the wallpaper value." + @SERROR
      $strWallP = ""
   EndIf
   ;
   ; Now check the screensaver.
   ;
   $intSelect             = 0
   $arrScrn[0,$intSelect] = "SCRNSAVE.EXE"
   $arrScrn[1,$intSelect] = ReadValue("HKEY_USERS\Temp\Control Panel\Desktop",$arrScrn[0,$intSelect])
   If @ERROR = 0
      If $arrScrn[1,$intSelect] <> ""
         ? "Customer's screen saver is set to: " + $arrScrn[1,$intSelect]
         $intErr = WriteProfileString($strFile,"Desktop","screensaver",$arrScrn[1,$intSelect])
         $arrTemp      = Split($arrScrn[1,$intSelect],"\",-1)
         $temp         = Ubound($arrTemp)
         $strScrnSName = $arrTemp[$temp]
         Select
            Case $strScrnSName = "ss3dfo.scr"
               ? "Customer is using the 3D flying object screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.3DFlyingObj"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
            Case $strScrnSName = "sspipes.scr"
               ? "Customer is using the 3D pipes screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.3DPipes"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
            Case $strScrnSName = "ssbezier.scr"
               ? "Customer is using the bezier curve screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Bezier"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
            Case $strScrnSName = "ssmarque.scr"
               ? "Customer is using the marque screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Marquee"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
            Case $strScrnSName = "ssmyst.scr"
               ? "Customer is using the mystify screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Mystify"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
            Case $strScrnSName = "ssstars.scr"
               ? "Customer is using the stars screen saver."
               $strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Stars"
               $temp   = EnumSS($strKey,$arrScrn,$strFile)
         EndSelect
      Else
         ? "Customer does not have a screen saver set."
         $intErr = WriteProfileString($strFile,"Desktop","screensaver","none")
      EndIf
   Else
      ? "Had trouble reading the screen saver value."
   EndIf
   ; Finished reading hive.  Need to unload it now.
   $intSelect = UnLoadHive("HKEY_USERS\Temp")
   If $intSelect <> 0
      ; Hive was not unloaded
      ? "Open regedit and check HKEY_USERS\Temp.  It was not unloaded."
      exit 3
   EndIf
Else
   ? "Could not load the hive, " + $arrDat[0,$intIndex] + "\" + $arrDat[1,$intIndex]
   exit 2
EndIf
Exit 0
;--------------------------------Functions------------------------------------
;
Function FSearch($strPath,$strPattern)
   ;
   ;NAME	FSearch
   ;
   ;ACTION	This function will search the given path to find files of the
   ;		given pattern and will search sub-directories.
   ;
   ;AUTHOR	Brad Van Orden
   ;		I took inspiration and guidance from Bryce Lindsay's DIRPLUS function.
   ;
   ;VERSION	0.8
   ;
   ;HISTORY	Created 25 Apr 07
   ;		15 May 07 Started adding checking for directory access is denied.
   ;
   ;SNYTAX	FSearch($strPath,$strPattern)
   ;
   ;PARAMETERS	strPath    - The path to start the search from.
   ;		strPattern - The pattern being searched.
   ;
   ;RETURNS	An array.  The sub-elements of each index will be:
   ;			UNC
   ;			file object - file name?
   ;DEPENDENCIES FSO
   ;
   ;EXAMPLE	
   ;
   DIM $strPathName, $strErr, $intErr, $strDate
   DIM $strFile, $strFilName, $arrResults[2,], $i
   ;
   $strPathName = CreateObject("Scripting.FileSystemObject").getfolder($strPath)
   If @ERROR
      ? "There was an error getting the folder handle."
   EndIf
   $i = -1
   For Each $strFile in $strPathName.subfolders
      $strFilName = Dir($strFile + "\" + $strPattern)
      $intErr = @ERROR
      $strErr = @SERROR
      Select
         Case $intErr = 5
            ? "You did not have permission to view this directory:"
            ? $strFile
            $strDate = GetFileTime($strFile)
            ? "It is dated: " + $strDate
            ? "If that is a directory you might want to examine, you need to repair the permissions on it."
         Case $intErr = 2
            ; This directory did not have the matching pattern.
         Case $intErr = 0
            ; A match was found.
            While $strFilName <> ""
               $i = $i + 1
               ReDIM preserve $arrResults[2,$i]
               $arrResults[0, $i] = $strFile
               $arrResults[1, $i] = $strFilName
               $arrResults[2, $i] = GetFileTime($strFile + "\" + $strPattern)
               $strFilName = Dir()
            Loop
         Case 1
            ? "Error number, " + $intErr + ", was reported - " $strErr
      EndSelect
   Next
   If Ubound($arrResults,2) < 0
      exit 2
   Else
      $FSearch = $arrResults
   EndIf
EndFunction
;
Function EnumSS($strKey,$arrScrn,$strFile)
   ;
   ;NAME	EnumSS
   ;
   ;ACTION	This function will query the registry for the given screen saver and
   ;            return all of it's settings.
   ;
   ;AUTHOR	Brad Van Orden
   ;
   ;VERSION	1.0
   ;
   ;HISTORY	Created 8 Jun 07
   ;            Added writing to the profile string.
   ;
   ;SNYTAX	EnumSS($strKey)
   ;
   ;PARAMETERS	strKey - The path to key to be searched.
   ;
   ;RETURNS	An array.  The sub-elements of each index will be:
   ;			UNC
   ;			file object - file name?
   ;DEPENDENCIES None
   ;
   ;EXAMPLE	
   ;
   Dim $intI, $strTemp, $intErr, $intSelect
   ;
   $intI    = 1
   $strTemp = EnumValue($strKey,$intI)
   $intErr  = @ERROR
   While $intErr = 0
      $intSelect  = $intSelect + 1
      ReDim Preserve $arrScrn[1,$intSelect]
      $arrScrn[0,$intSelect] = $strTemp
      $arrScrn[1,$intSelect] = ReadValue($strKey,$arrScrn[0,$intSelect])
      ? "Value, " + $arrScrn[0,$intSelect] + ", is set to: " + $arrScrn[1,$intSelect]
      $intErr = WriteProfileString($strFile,"Desktop",$arrScrn[0,$intSelect],$arrScrn[1,$intSelect])
      $intI = $intI + 1
      $strTemp = EnumValue($strKey,$intI)
      $intErr     = @ERROR
   Loop
EndFunction