{"id":12131,"date":"2011-11-10T00:01:00","date_gmt":"2011-11-10T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/11\/10\/use-powershell-to-find-user-profiles-on-a-computer\/"},"modified":"2011-11-10T00:01:00","modified_gmt":"2011-11-10T00:01:00","slug":"use-powershell-to-find-user-profiles-on-a-computer","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-find-user-profiles-on-a-computer\/","title":{"rendered":"Use PowerShell to Find User Profiles on a Computer"},"content":{"rendered":"

Summary:<\/strong> Learn how to use Windows PowerShell to find all user profiles on a computer, and to display the date when each profile was last used.<\/span><\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>Hey, Scripting Guy! I would like to find a good way to see which profiles exist on my laptop. I found a Hey, Scripting Guy! post to do this, but it uses VBScript. Can this be done using Windows PowerShell?<\/span><\/p>\n

—CW<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span><\/span><\/span>Hello CW, <\/span><\/p>\n

Microsoft Scripting Guy Ed Wilson here. A few years ago (actually more like six years ago), there was a Hey, Scripting Guy! Blog post entitled <\/span>Hey, Scripting Guy! How Can I List All the User Profiles on a Computer?<\/span><\/a> That post talks about enumerating a registry key to find the profile information. The registry location did not change in Windows 7, so the VBScript would still work. Here is the registry location:<\/span><\/span><\/p>\n

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList<\/span><\/p>\n

The registry location viewed in the Registry Editor appears in the following figure.<\/span><\/p>\n

\"Image<\/a><\/span><\/p>\n

Using Windows PowerShell, it is really easy to get and to display registry keys. I can enumerate the profile keys in a single command. However, due to the length of registry keys, I am going to do it in two lines. In the code that follows, I first store the path to the registry (using the HKLM<\/b> Windows PowerShell drive) in a variable. Next, I use the Get-ChildItem<\/b> cmdlet (dir<\/b> is an alias) to list the registry profile keys:<\/span><\/p>\n

$profileList = ‘HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList’<\/span><\/p>\n

dir $profilelist<\/span><\/p>\n

The following illustrates using these two commands, as well as shows the results on my Windows 7 laptop:<\/span><\/p>\n

PS C:\\> $profileList = ‘HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList’<\/span><\/p>\n

PS C:\\> dir $profilelist<\/span><\/p>\n

 <\/span><\/p>\n

    Hive: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList<\/span><\/p>\n

 <\/span><\/p>\n

SKC<\/span>                  VC Name<\/span>                                              Property<\/span><\/span><\/p>\n

  0                    5 S-1-5-18                                             {Flags, State, RefCount, Sid…}<\/span><\/p>\n

  0                    3 S-1-5-19                                             {ProfileImagePath, Flags, State}<\/span><\/p>\n

  0                    3 S-1-5-20                                             {ProfileImagePath, Flags, State}<\/span><\/p>\n

  0                    10 S-1-5-21-124525095-70825963       {ProfileImagePath, Flags, State, Sid…}<\/span><\/p>\n

  0                    7 S-1-5-21-1266540227-3509270         {ProfileImagePath, Flags, State, Sid…}<\/span><\/p>\n

  0                    8 S-1-5-21-1266540227-3509270         {ProfileImagePath, Flags, State, Sid…}<\/span><\/p>\n

Now that I have a listing of the profiles on the machine, I need to expand a couple of properties, such as ProfileImagePath<\/b> <\/i>and Sid<\/b>.<\/i> This should be a simple matter of using the Get-ItemProperty<\/b> cmdlet to retrieve the name<\/b> <\/i>property from the list above. When I do this, however, an error arises. The command and associated error are shown here.<\/span><\/p>\n

\"Image<\/a><\/span><\/p>\n

There are actually two problems going on here. The first is that what is displayed under the Name <\/i>column in the default output from the Get-Childitem<\/b> cmdlet is not the actual value stored in the actual name<\/b> <\/i>property. The second problem is that even if that were fixed, the value HKEY_LOCAL_MACHINE<\/b> that the name<\/b> <\/i>property contains as part of the value is not the name of the Windows PowerShell drive used by the Get-ItemProperty<\/b> cmdlet. I discovered this by piping the results of the Get-ChildItem<\/b> command to the Format-List<\/b> cmdlet (fl<\/b> is an alias for Format-List<\/b>) and analyzing the output. The following figure illustrates this process.<\/span><\/p>\n

\"Image<\/a><\/span><\/p>\n

From the results discovered via Format-List<\/b>, I ascertain I need to use the pspath<\/b> <\/i>property because it includes the registry provider. I can then pipe the results to the Select-Object<\/b> cmdlet, and choose the ProfileImagePath<\/b> <\/i>property and the Sid<\/b> <\/i>property. This code and associated output are shown here (the %<\/b> character is an alias for the Foreach-Object<\/b> cmdlet and Select<\/b> is an alias for the Select-Object<\/b> cmdlet):<\/span><\/p>\n

PS C:\\> $profileList = ‘HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList’<\/span><\/p>\n

PS C:\\> Get-childItem ‘HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList’ | % {Get-ItemProperty $_.pspath } | Select profileImagePath, sid<\/span><\/p>\n

 <\/span><\/p>\n

ProfileImagePath<\/span>                                                            Sid<\/span><\/span><\/p>\n

C:\\windows\\system32\\config\\systemprofile                   {1, 1, 0, 0…}<\/span><\/p>\n

C:\\Windows\\ServiceProfiles\\LocalService<\/span><\/p>\n

C:\\Windows\\ServiceProfiles\\NetworkService<\/span><\/p>\n

C:\\Users\\edwils                                                                {1, 5, 0, 0…}<\/span><\/p>\n

C:\\Users\\UpdatusUser                                                     {1, 5, 0, 0…}<\/span><\/p>\n

C:\\Users\\Administrator                                                    {1, 5, 0, 0…}<\/span><\/p>\n

CW, that is an interesting excursion into working with the registry to retrieve user profile information. However, if it were me, I would just use Windows Management Instrumentation (WMI) instead. In fact, it returns even more information that is obtainable via the registry. Here is a simple command to return exactly the same information we just got from the registry (gwmi<\/b> is an alias for the Get-WmiObject<\/b> cmdlet):<\/span><\/p>\n

gwmi win32_userprofile | select localpath, sid<\/span><\/p>\n

The command and associated output are shown here:<\/span><\/p>\n

PS C:\\> gwmi win32_userprofile | select localpath, sid<\/span><\/p>\n

localpath                                                              sid<\/span><\/p>\n

———                                                                —<\/span><\/p>\n

C:\\Users\\Administrator                                         S-1-5-21-1266540227-3509270964-2815946151-500<\/span><\/p>\n

C:\\Users\\UpdatusUser                                           S-1-5-21-1266540227-3509270964-2815946151-1001<\/span><\/p>\n

C:\\Users\\edwils                                                      S-1-5-21-124525095-708259637-1543119021-179756<\/span><\/p>\n

C:\\Windows\\ServiceProfiles\\NetworkService         S-1-5-20<\/span><\/p>\n

C:\\Windows\\ServiceProfiles\\LocalService               S-1-5-19<\/span><\/p>\n

C:\\windows\\system32\\config\\systemprofile           S-1-5-18<\/span><\/p>\n

If I run the WMI command with administrator rights, I can find the last time each profile was used. This information might be useful from a cleanup perspective. Here is the command to do that. Here are the aliases the following command uses:<\/span><\/p>\n

PS C:\\> Get-Alias gwmi, select, ft<\/span><\/p>\n

 <\/span><\/p>\n

CommandType<\/span>              Name<\/span>                           Definition<\/span><\/span><\/p>\n

Alias                              gwmi                             Get-WmiObject<\/span><\/p>\n

Alias                              select                             Select-Object<\/span><\/p>\n

Alias                              ft                                    Format-Table<\/span><\/p>\n

Here is the code to get the user profiles, convert the time from WMI format to a regular date time value, and display the path and SID:<\/span><\/p>\n

gwmi win32_userprofile | <\/span><\/p>\n

select @{LABEL=”last used”;EXPRESSION={$_.ConvertToDateTime($_.lastusetime)}},<\/span><\/p>\n

LocalPath, SID | ft -a<\/span><\/p>\n

<\/span> <\/p>\n

CW, that is all there is to finding profiles on a computer. Join me tomorrow for more cool Windows PowerShell stuff. <\/span><\/p>\n

I invite you to follow me on <\/span>Twitter<\/span><\/a> and <\/span>Facebook<\/span><\/a>. If you have any questions, send email to me at <\/span>scripter@microsoft.com<\/span><\/a>, or post your questions on the <\/span>Official Scripting Guys Forum<\/span><\/a>. See you tomorrow. Until then, peace.<\/span><\/span><\/p>\n<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/span><\/p>\n

<\/span> <\/p>\n

 <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to use Windows PowerShell to find all user profiles on a computer, and to display the date when each profile was last used.   Hey, Scripting Guy! I would like to find a good way to see which profiles exist on my laptop. I found a Hey, Scripting Guy! post to do […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[16,31,26,3,94,45],"class_list":["post-12131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-desktop-management","tag-operating-system","tag-registry","tag-scripting-guy","tag-special-folders","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Learn how to use Windows PowerShell to find all user profiles on a computer, and to display the date when each profile was last used.   Hey, Scripting Guy! I would like to find a good way to see which profiles exist on my laptop. I found a Hey, Scripting Guy! post to do […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=12131"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/12131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=12131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=12131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=12131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}