;NAME ntuser.kx
;
;DESCRIPTION This is a script to find an old ntuser.dat file
; for a given user and search it for printer and drive mappings.
;
;AUTHOR Brad Van Orden
;
;VERSION 1.0
;
;HISTORY Created 25 Apr 07
; 30 Apr 07 - Added in file time to display.
; 1 May 07 - Finished enumerating and reading mapped network drives.
; Added printer connections.
; 15 May 07 - Added in color scheme and screen saver information.
; 17 May 07 - Added in some error handling for not finding an ntuser.dat file.
; 8 Jun 07 - Added some more screen saver selections.
; Added some code to write all of the information to a text file.
;
Break On
;
Dim $SO
;
; These are just programming options for me.
; One forces me to define all variables and the
; other doesn't allow a kixtart macro within a string.
;
$SO = SetOption('Explicit', 'On')
$SO = SetOption('NoMacrosInStrings', 'On')
;
DIM $objUser, $strUser, $strDomain, $strHomeD, $strDAT, $temp
DIM $arrDAT[0,0], $intIndex, $intCounter, $strMesg, $intSelect
DIM $strKey, $intIndex2, $arrMap[1,0], $strDefP, $intDAT, $strClrSchm
DIM $strWallP, $arrTemp, $strScrnSName, $strProfD
DIM $strMQText, $strMQAtt, $strMQBC, $strMQCS, $strMQFont, $strMQMode, $strMQSz
DIM $strMQSpd, $strMQTextC, $strFile
DIM $arrScrn[1,0], $intI, $intErr, $strTemp
;
$strDomain = @LDOMAIN
;
While $strUser == ""
? "Please enter the login ID of the person:"
Gets $strUser
Loop
;
$objUser = GetObject("WinNT://" + $strDomain + "/" + $strUser + ",user")
If @ERROR <> 0
? "Could not find the user in active directory, " + $strUser
exit 1
EndIf
;
$strHomeD = $objUser.HomeDirectory
$strProfD = $strHomeD + "\_sys"
;
$arrDAT = FSearch($strProfD,"ntuser.dat")
If @ERROR = 2
? "Could not find an ntuser.dat file for this user."
exit 2
EndIf
;
$intIndex = Ubound($arrDat,2)
$strMesg = ""
For $intCounter = 0 to $intIndex
If $strMesg = ""
$strMesg = "Count" + Chr(9) + "Path" + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + Chr(9) + "FileName" + Chr(9) + Chr(9) + "Date"
EndIf
$strMesg = $strMesg + Chr(13) + $intCounter + Chr(9) + $arrDat[0,$intCounter] + Chr(9) + $arrDat[1,$intCounter] + Chr(9) + $arrDat[2,$intCounter]
Next
;
$intSelect = MessageBox($strMesg,"Click on OK and Make a Selection at the Command Prompt",4144)
$intDAT = -1
While $intDAT < 0 or $intDat > $intIndex
? "Enter your selection: "
Gets $intDAT
Loop
? "You selected, " + $intDAT
;
; Now read the data from the ntuser.dat file.
$intSelect = LoadHive("HKEY_USERS\Temp", $arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT])
If $intSelect = 0
; Start writing the data to a file.
$strFile = "C:\Documents and Settings\" + @userid + "\Desktop\" + $strUser + "_profdat.ini"
$intErr = WriteProfileString($strFile,"Home Path","homed",$strHomeD)
? "Home directory is: " + $strHomeD
$intErr = WriteProfileString($strFile,"Path Searched","HKU",$arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT])
? "ntuser.dat file examined is: " + $arrDat[0,$intDAT] + "\" + $arrDat[1,$intDAT]
;
; Hive is loaded, now read the data. This section will retrieve persistent drive mappings.
$intSelect = 0
$intIndex2 = 0
$strKey = EnumKey("HKEY_USERS\Temp\Network", $intSelect)
While @Error = 0
ReDim Preserve $arrMap[1,$intIndex2]
? "Found key: " + $strKey
$arrMap[0, $intIndex2] = $strKey
$arrMap[1, $intIndex2] = ReadValue("HKEY_USERS\Temp\Network\" + $strKey, "RemotePath")
? "Remote Path = " + $arrMap[1, $intIndex2]
$intErr = WriteProfileString($strFile,"Persistent Connections",$arrMap[0, $intIndex2],$arrMap[1, $intIndex2])
$intIndex2 = $intIndex2 + 1
$intSelect = $intSelect + 1
$strKey = EnumKey("HKEY_USERS\Temp\Network", $intSelect)
Loop
;
; Next, read printer information
; The default printer is found at HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
;
$strDefP = ReadValue("HKEY_USERS\Temp\Software\Microsoft\Windows NT\CurrentVersion\Windows","Device")
$strDefP = Substr($strDefP,1,Instr($strDefP,",")-1)
? "The default printer is: " + $strDefP
$intErr = WriteProfileString($strFile,"Printers","Default",$strDefP)
;
; Now get all of the mapped printers.
;
$intSelect = 0
$strKey = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
While @Error = 0
ReDim Preserve $arrMap[1,$intIndex2]
$temp = Split($strKey,",",4)
$arrMap[0, $intIndex2] = $temp[2]
$arrMap[1, $intIndex2] = $temp[3]
? "Found printer, " + $arrMap[1, $intIndex2] + ", through server, " + $arrMap[0, $intIndex2]
$intErr = WriteProfileString($strFile,"Printers",$arrMap[0, $intIndex2],$arrMap[1, $intIndex2])
$intIndex2 = $intIndex2 + 1
$intSelect = $intSelect + 1
$strKey = EnumKey("HKEY_USERS\Temp\Printers\Connections", $intSelect)
Loop
;
; Now check color scheme
$strClrSchm = ReadValue("HKEY_USERS\Temp\Control Panel\Current","Color Schemes")
If @ERROR = 0
? "Color scheme is set to: " + $strClrSchm
Else
? "Could not read the color scheme. Will set it to Windows Standard."
$strClrSchm = "Windows Standard"
EndIf
$intErr = WriteProfileString($strFile,"Desktop","Scheme",$strClrSchm)
;
; Check wallpaper
;
$strWallP = ReadValue("HKEY_USERS\Temp\Control Panel\Desktop","Wallpaper")
If @ERROR = 0
If $strWallP <> ""
? "Customer's wallpaper is set to: " + $strWallP
$intErr = WriteProfileString($strFile,"Desktop","paper",$strWallP)
Else
? "Customer does not have any wallpaper set."
$intErr = WriteProfileString($strFile,"Desktop","paper","none")
EndIf
Else
? "Had trouble reading the wallpaper value." + @SERROR
$strWallP = ""
EndIf
;
; Now check the screensaver.
;
$intSelect = 0
$arrScrn[0,$intSelect] = "SCRNSAVE.EXE"
$arrScrn[1,$intSelect] = ReadValue("HKEY_USERS\Temp\Control Panel\Desktop",$arrScrn[0,$intSelect])
If @ERROR = 0
If $arrScrn[1,$intSelect] <> ""
? "Customer's screen saver is set to: " + $arrScrn[1,$intSelect]
$intErr = WriteProfileString($strFile,"Desktop","screensaver",$arrScrn[1,$intSelect])
$arrTemp = Split($arrScrn[1,$intSelect],"\",-1)
$temp = Ubound($arrTemp)
$strScrnSName = $arrTemp[$temp]
Select
Case $strScrnSName = "ss3dfo.scr"
? "Customer is using the 3D flying object screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.3DFlyingObj"
$temp = EnumSS($strKey,$arrScrn,$strFile)
Case $strScrnSName = "sspipes.scr"
? "Customer is using the 3D pipes screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.3DPipes"
$temp = EnumSS($strKey,$arrScrn,$strFile)
Case $strScrnSName = "ssbezier.scr"
? "Customer is using the bezier curve screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Bezier"
$temp = EnumSS($strKey,$arrScrn,$strFile)
Case $strScrnSName = "ssmarque.scr"
? "Customer is using the marque screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Marquee"
$temp = EnumSS($strKey,$arrScrn,$strFile)
Case $strScrnSName = "ssmyst.scr"
? "Customer is using the mystify screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Mystify"
$temp = EnumSS($strKey,$arrScrn,$strFile)
Case $strScrnSName = "ssstars.scr"
? "Customer is using the stars screen saver."
$strKey = "HKEY_USERS\Temp\Control Panel\Screen Saver.Stars"
$temp = EnumSS($strKey,$arrScrn,$strFile)
EndSelect
Else
? "Customer does not have a screen saver set."
$intErr = WriteProfileString($strFile,"Desktop","screensaver","none")
EndIf
Else
? "Had trouble reading the screen saver value."
EndIf
; Finished reading hive. Need to unload it now.
$intSelect = UnLoadHive("HKEY_USERS\Temp")
If $intSelect <> 0
; Hive was not unloaded
? "Open regedit and check HKEY_USERS\Temp. It was not unloaded."
exit 3
EndIf
Else
? "Could not load the hive, " + $arrDat[0,$intIndex] + "\" + $arrDat[1,$intIndex]
exit 2
EndIf
Exit 0
;--------------------------------Functions------------------------------------
;
Function FSearch($strPath,$strPattern)
;
;NAME FSearch
;
;ACTION This function will search the given path to find files of the
; given pattern and will search sub-directories.
;
;AUTHOR Brad Van Orden
; I took inspiration and guidance from Bryce Lindsay's DIRPLUS function.
;
;VERSION 0.8
;
;HISTORY Created 25 Apr 07
; 15 May 07 Started adding checking for directory access is denied.
;
;SNYTAX FSearch($strPath,$strPattern)
;
;PARAMETERS strPath - The path to start the search from.
; strPattern - The pattern being searched.
;
;RETURNS An array. The sub-elements of each index will be:
; UNC
; file object - file name?
;DEPENDENCIES FSO
;
;EXAMPLE
;
DIM $strPathName, $strErr, $intErr, $strDate
DIM $strFile, $strFilName, $arrResults[2,], $i
;
$strPathName = CreateObject("Scripting.FileSystemObject").getfolder($strPath)
If @ERROR
? "There was an error getting the folder handle."
EndIf
$i = -1
For Each $strFile in $strPathName.subfolders
$strFilName = Dir($strFile + "\" + $strPattern)
$intErr = @ERROR
$strErr = @SERROR
Select
Case $intErr = 5
? "You did not have permission to view this directory:"
? $strFile
$strDate = GetFileTime($strFile)
? "It is dated: " + $strDate
? "If that is a directory you might want to examine, you need to repair the permissions on it."
Case $intErr = 2
; This directory did not have the matching pattern.
Case $intErr = 0
; A match was found.
While $strFilName <> ""
$i = $i + 1
ReDIM preserve $arrResults[2,$i]
$arrResults[0, $i] = $strFile
$arrResults[1, $i] = $strFilName
$arrResults[2, $i] = GetFileTime($strFile + "\" + $strPattern)
$strFilName = Dir()
Loop
Case 1
? "Error number, " + $intErr + ", was reported - " $strErr
EndSelect
Next
If Ubound($arrResults,2) < 0
exit 2
Else
$FSearch = $arrResults
EndIf
EndFunction
;
Function EnumSS($strKey,$arrScrn,$strFile)
;
;NAME EnumSS
;
;ACTION This function will query the registry for the given screen saver and
; return all of it's settings.
;
;AUTHOR Brad Van Orden
;
;VERSION 1.0
;
;HISTORY Created 8 Jun 07
; Added writing to the profile string.
;
;SNYTAX EnumSS($strKey)
;
;PARAMETERS strKey - The path to key to be searched.
;
;RETURNS An array. The sub-elements of each index will be:
; UNC
; file object - file name?
;DEPENDENCIES None
;
;EXAMPLE
;
Dim $intI, $strTemp, $intErr, $intSelect
;
$intI = 1
$strTemp = EnumValue($strKey,$intI)
$intErr = @ERROR
While $intErr = 0
$intSelect = $intSelect + 1
ReDim Preserve $arrScrn[1,$intSelect]
$arrScrn[0,$intSelect] = $strTemp
$arrScrn[1,$intSelect] = ReadValue($strKey,$arrScrn[0,$intSelect])
? "Value, " + $arrScrn[0,$intSelect] + ", is set to: " + $arrScrn[1,$intSelect]
$intErr = WriteProfileString($strFile,"Desktop",$arrScrn[0,$intSelect],$arrScrn[1,$intSelect])
$intI = $intI + 1
$strTemp = EnumValue($strKey,$intI)
$intErr = @ERROR
Loop
EndFunction
