Access a specific user environment variable on windows server

Is there a way to access to a specific user environment variable using Powershell ?

On the server machine, we have 50 users.
I want to know if a specific user for example user1 is using a different value for the environment variable PYTH_HOME_LOG.

This System variable points to C:PYTHONLOG, I want to check which user changed this location by configuring a user environment variable PYTH_HOME_LOG.

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

I think the answer here will point you in the right direction: stackoverflow.com/questions/10737401/…

– gvee
Jan 3 at 13:45

@gvee : this allow you to set your environment as system or user, but not to access other user environment variable.

– Linus
Jan 3 at 13:59

You posted an answer (since deleted) saying that this answer by Mathias solved your problem. If so, please update your question to indicate that you only want to check users with a loaded profile (ntuser.dat), either from an active logon or lingering (temporarily) from a previous logon.

– eryksun
Jan 5 at 18:07

add a comment |

Is there a way to access to a specific user environment variable using Powershell ?

On the server machine, we have 50 users.
I want to know if a specific user for example user1 is using a different value for the environment variable PYTH_HOME_LOG.

This System variable points to C:PYTHONLOG, I want to check which user changed this location by configuring a user environment variable PYTH_HOME_LOG.

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

I think the answer here will point you in the right direction: stackoverflow.com/questions/10737401/…

– gvee
Jan 3 at 13:45

@gvee : this allow you to set your environment as system or user, but not to access other user environment variable.

– Linus
Jan 3 at 13:59

You posted an answer (since deleted) saying that this answer by Mathias solved your problem. If so, please update your question to indicate that you only want to check users with a loaded profile (ntuser.dat), either from an active logon or lingering (temporarily) from a previous logon.

– eryksun
Jan 5 at 18:07

add a comment |

Is there a way to access to a specific user environment variable using Powershell ?

On the server machine, we have 50 users.
I want to know if a specific user for example user1 is using a different value for the environment variable PYTH_HOME_LOG.

This System variable points to C:PYTHONLOG, I want to check which user changed this location by configuring a user environment variable PYTH_HOME_LOG.

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

Is there a way to access to a specific user environment variable using Powershell ?

On the server machine, we have 50 users.
I want to know if a specific user for example user1 is using a different value for the environment variable PYTH_HOME_LOG.

This System variable points to C:PYTHONLOG, I want to check which user changed this location by configuring a user environment variable PYTH_HOME_LOG.

windows powershell environment-variables window-server

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

edited Jan 3 at 20:05

Ansgar Wiechers

146k13132190

asked Jan 3 at 13:43

Linus

114

asked Jan 3 at 13:43

Linus

114

asked Jan 3 at 13:43

Linus

114

I think the answer here will point you in the right direction: stackoverflow.com/questions/10737401/…

– gvee
Jan 3 at 13:45

@gvee : this allow you to set your environment as system or user, but not to access other user environment variable.

– Linus
Jan 3 at 13:59

You posted an answer (since deleted) saying that this answer by Mathias solved your problem. If so, please update your question to indicate that you only want to check users with a loaded profile (ntuser.dat), either from an active logon or lingering (temporarily) from a previous logon.

– eryksun
Jan 5 at 18:07

add a comment |

I think the answer here will point you in the right direction: stackoverflow.com/questions/10737401/…

– gvee
Jan 3 at 13:45

@gvee : this allow you to set your environment as system or user, but not to access other user environment variable.

– Linus
Jan 3 at 13:59

You posted an answer (since deleted) saying that this answer by Mathias solved your problem. If so, please update your question to indicate that you only want to check users with a loaded profile (ntuser.dat), either from an active logon or lingering (temporarily) from a previous logon.

– eryksun
Jan 5 at 18:07

I think the answer here will point you in the right direction: stackoverflow.com/questions/10737401/…

– gvee
Jan 3 at 13:45

@gvee : this allow you to set your environment as system or user, but not to access other user environment variable.

– Linus
Jan 3 at 13:59

You posted an answer (since deleted) saying that this answer by Mathias solved your problem. If so, please update your question to indicate that you only want to check users with a loaded profile (ntuser.dat), either from an active logon or lingering (temporarily) from a previous logon.

– eryksun
Jan 5 at 18:07

add a comment |

1 Answer
1

active

oldest

votes

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS |Where Name -like "HKEY_USERSS-1-5-21*[0-9]"

foreach($UserHive in $AllUserHives){

  if(Get-ItemProperty -Path "$UserHiveEnvironment" -Name PYTH_HOME_LOG -EA SilentlyContinue){

    # User is overriding %PYTH_HOME_LOG%

  }

}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\')[-1] -as [System.Security.Principal.SecurityIdentifier]

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54023494%2faccess-a-specific-user-environment-variable-on-windows-server%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS |Where Name -like "HKEY_USERSS-1-5-21*[0-9]"

foreach($UserHive in $AllUserHives){

  if(Get-ItemProperty -Path "$UserHiveEnvironment" -Name PYTH_HOME_LOG -EA SilentlyContinue){

    # User is overriding %PYTH_HOME_LOG%

  }

}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\')[-1] -as [System.Security.Principal.SecurityIdentifier]

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

add a comment |

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS |Where Name -like "HKEY_USERSS-1-5-21*[0-9]"

foreach($UserHive in $AllUserHives){

  if(Get-ItemProperty -Path "$UserHiveEnvironment" -Name PYTH_HOME_LOG -EA SilentlyContinue){

    # User is overriding %PYTH_HOME_LOG%

  }

}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\')[-1] -as [System.Security.Principal.SecurityIdentifier]

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

add a comment |

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS |Where Name -like "HKEY_USERSS-1-5-21*[0-9]"

foreach($UserHive in $AllUserHives){

  if(Get-ItemProperty -Path "$UserHiveEnvironment" -Name PYTH_HOME_LOG -EA SilentlyContinue){

    # User is overriding %PYTH_HOME_LOG%

  }

}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\')[-1] -as [System.Security.Principal.SecurityIdentifier]

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

If you are a member of the local Administrators group you can simply go through all the user registry hives and search for the Environment variables there:

$AllUserHives = Get-ChildItem Registry::HKEY_USERS |Where Name -like "HKEY_USERSS-1-5-21*[0-9]"

foreach($UserHive in $AllUserHives){

  if(Get-ItemProperty -Path "$UserHiveEnvironment" -Name PYTH_HOME_LOG -EA SilentlyContinue){

    # User is overriding %PYTH_HOME_LOG%

  }

}

You can grab the corresponding user name either from the Volatile Environment registry subtree by searching for the USERNAME env variable, or you can use IdentityReference.Translate():

$SID = [System.Security.Principal.SecurityIdentifier]"S-1-5-21-436246-18267386-368368356-356777"

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

or, in this case:

$SID = ($UserHive -split '\')[-1] -as [System.Security.Principal.SecurityIdentifier]

$Username = $SID.Translate([System.Security.Principal.NTAccount]).Value

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

edited Jan 3 at 21:15

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

answered Jan 3 at 17:07

Mathias R. Jessen

59.2k564109

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

add a comment |

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

You're not loading the user profile, so this only checks accounts that are logged on with the profile loaded.

– eryksun
Jan 3 at 22:06

"RegistryUser" (predefined handle HKEY_USERS) is a dynamic key where user profile hives are loaded (e.g. "%USERPROFILE%NTUSER.DAT" and "%LOCALAPPDATA%MicrosoftWindowsUsrClass.dat"). The profile gets loaded via LoadUserProfile, which makes an RPC to the User Profile service. The caller must have the backup and restore admin privileges. The service gets the account's SID string and looks up the "ProfileImagePath" in "SoftwareMicrosoftWindows NTCurrentVersionProfileList" relative to "RegistryMachine" (predefined handle HKEY_LOCAL_MACHINE), and loads the keys via NtLoadKeyEx.

– eryksun
Jan 3 at 22:06

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Bdtjtk