Question

I need to modify settings of a user-mode program from a local service application using C++ and WinAPIs. With most user accounts, I can access them by reading the following registry keys:

HKEY_USERS\ [UserSID] \Software

But I can’t seem to find a user hive for a built-in Guest account. Any idea where it’s settings are stored in the Registry?

PS. The local service is a 32-bit application.

Answer 1

The Guest account is SID S-1-5-21-domain-501, which does not have its own Registry key, AFAIK.

See Well-Known SIDs and Well-known security identifiers.

The correct way to manipulate a specific user’s Registry hive is to impersonate the user and then use RegOpenCurrentUser() to access that user’s HKEY_CURRENT_USER key normally, not to manipulate the HKEY_USERS key directly.