Editing a users registry (HKCU) in Citrix when the user is restricted

I ran across this issue today where i needed to enforce taskbar settings to avoid conditions where the users taskbar was moved or set to autohide, first i had to see if i could change it for one user without using GPOs… ultimately i want to lock the bar to the bottom, and force it to always be visable. The following shows how to edit the HKCU for another user on the system (as you would for a locked down system like XenApp etc)

Question

Can HKEY_CURRENT_USER be edited in the registry for a restricted user profile, when logged in as the administrator?

Answer

Some user profiles are restricted from starting the registry editor or from making changes to the registry. However, when the administrator logs into the computer, the information stored in HKEY_CURRENT_USER is specific to the administrator’s profile.

All user’s HKEY_CURRENT_USER information is available in the registry under HKEY_USERS, identified by their Security Identifier (SID). Refer to the knowledge base article titled, “Match a user profile to folders in HKEY_USERS”, in the Related Information section for information on how to identify the SID for the desired user profile, so that edits to their HKEY_CURRENT_USER can be made.

When working with roaming profiles, make sure to edit the correct roaming profile and not a stale copy of the profile by the same name.

Summary

Instructions provided describe how to identify which folder stored in the registry under HKEY_USERS is associated with each user profile on the computer.

The Security Identifier (SID) is a unique name (an alphanumeric character string) that is assigned by a Windows Domain controller during the login process that is used to identify a user.

This procedure enables administrators to make modifications to specific user profiles located in HKEY_USERS, mimicking those found in HKEY_CURRENT_USER when that user is logged in.

 

Procedure

  1. Expand HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
  2. Select each folder individually and look at the ‘ProfileImagePath’ key to identify the user profile associated with the selected folder:
    The folder name in the above example; it is S-1-5-21-2060139532-2050374463-2073913816-1157.
  3. Expand HKEY_USERS\<folder>. In this example, HKEY_USERS\S-1-5-21-2060139532-2050374463-2073913816-1157. This is that user’s HKEY_CURRENT_USER. Proceed with the desired modification:

I also found this great article on DABCC that breaks down the registry values for the taskbar settings

http://www.dabcc.com/article.aspx?id=9724