code:

---

FUNCTION WMIQuery($what,$where, optional $computer)
	dim $strQuery, $objEnumerator, $value
	if not $computer	$computer="@WKSTA"	endif
	$strQuery = "Select $what From $where"
	$SystemSet = GetObject("winmgmts:{impersonationLevel=impersonate}!//$computer")
	$objEnumerator = $SystemSet.ExecQuery($strQuery)
	For Each $objInstance in $objEnumerator
		If @Error = 0 and $objInstance <> ""
			$=execute("$$value = $$objInstance.$what")
			$WMIQuery="$value"+"|"+"$WMIQuery"
			EndIf
		Next
	$WMIQuery=left($WMIQuery,len($WMIQuery)-1)
	exit @error
	ENDFUNCTION

---

code:

---

 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName
 

---

code:

---

Break On
For Each $key In fEnumKey("ComputerName", "HKEY_USERS")
   If Left($key,3) = "S-1" and Instr($key,"_") = 0
      ? GetAdsPathFromHexSid(StrSidToHexSid($key))
   Endif
Next
exit 0


;FUNCTION         GetAdsPathFromHexSid($HexSid)
;
;AUTHOR           Howard A. Bullock (hbullock@comcast.net)
;
;ACTION           Uses ADsSecurity.DLL to translate a Hex Sid into the
;                 objects AdsPath.
;
;SYNTAX           GetAdsPathFromHexSid($HexSid)
;
;PARAMETERS       $HexSid (Required) -  String value
;
;REMARKS          ADsSecurity.Dll required
;
;RETURNS          String - ADsPath path of object represented by a Hex Sid.
;
;DEPENDENCIES     KiXtart 4.02
;
;EXAMPLES
;    GetAdsPathFromHexSid("010500000000000515000000BC2E7001633DBD3D0E6D055C79050000")
;
Function GetAdsPathFromHexSid($HexSid)
      Dim $oADsSid
      $GetAdsPathFromHexSid = ""
      $oADsSid = CreateObject("ADsSid")
      If VarTypeName($oADsSid) = 'Object'
         $oADsSid.SetAS(1,$HexSid)
         If @Error <> 0
            ? "Failed: SetAS(1,$HexSid) @Error @Serror"
            Exit 1
         Endif
         $GetAdsPathFromHexSid=$oADsSid.GetAS(5)
         If @Error <> 0
            ? "Failed: GetAS(5) @Error @Serror"
            Exit 1
         Endif
      Else
         ? "CreateObject('ADsSid') Failed. @Error  @Serror"
         ? "AdsSecurity.DLL required."
         Exit 1
      Endif
      Exit 0
Endfunction


;FUNCTION         fEnumKey($Computer, $Key)
;
;AUTHOR           Howard A. Bullock (hbullock@comcast.net)
;
;ACTION           Enumerates registries keys on the specified computer.
;
;SYNTAX           fEnumKey($Computer, $Key)
;
;PARAMETERS       $Computer (Required) -  String value
;                 $Key (Required) -  String value
;
;REMARKS          Do not prefix the computer name with "\\"'s.
;
;RETURNS          Array of keys names.
;
;DEPENDENCIES     KiXtart 4.02
;
;EXAMPLES         fEnumKey("", "HKEY_USERS")
;                 fEnumKey("Remote1", "HKEY_USERS")
;
Function fEnumKey($Server, $Key)
   Dim $Index, $Error
   $Index = 0
   Dim $KeyName[$Index]
   If $Server <> ""
      $Key = "\\" + $Server + "\" + $Key
   Endif

   If KeyExist($Key)
      Do
         $KeyName[$Index] = ENUMKEY($Key, $Index)
         $Error = @Error
         If NOT $Error
            $Index = $Index + 1
            ReDim PRESERVE $KeyName[$Index]
         Else
            $Index = $Index - 1
            ReDim PRESERVE $KeyName[$Index]
         Endif
      Until $Error
   Else
      $KeyName[0] = ""
      Exit 2
   Endif
   $fEnumKey = $KeyName
   Exit 0
Endfunction

;FUNCTION         StrSidToHexSid($StringSid)
;
;AUTHOR           Howard A. Bullock (hbullock@comcast.net)
;
;ACTION           Converts a Sid in string (S-1-5-21-...) format to Hex format.
;
;SYNTAX           StrSidToHexSid($StringSid)
;
;PARAMETERS       $StringSid (Required) -  String value
;
;REMARKS          Do not prefix the computer name with "\\"'s.
;
;RETURNS          String
;
;DEPENDENCIES     KiXtart 4.02
;
;EXAMPLES         StrSidToHexSid("S-1-5-21-24129212-1035812195-1543859470-1401")
;         returns "010500000000000515000000BC2E7001633DBD3D0E6D055C79050000"
;
Function StrSidToHexSid($StringSid)
   dim $i, $j, $Parts, $Sac, $Sid, $x

   $Sid = ""
   If Left($StringSid,4) = "S-1-"
      $Parts = split($StringSid, "-")

      For $i=1 to 2
         $Sid = $Sid + PadStr(DecToHex($Parts[$i]),0,2)
      Next

      $Sac = Ubound($Parts) - 2
      $Sid = $Sid + PadStr($Sac,0,12)

      For $i=1 to $Sac
         $x = PadStr(DecToHex($Parts[$i+2]),0,8)
         For $j=7 to 1 Step -2
            $Sid = $Sid + Substr($x,$j,2)
         Next
      Next
   Else
      ? "StrSidToHexSid - Invalid input"
      Exit 1
   Endif
   $StrSidToHexSid = $Sid
   Exit 0
Endfunction

;FUNCTION         PadStr($Input,$Pad,$Length)
;
;AUTHOR           Howard A. Bullock (hbullock@comcast.net)
;
;ACTION           Left or Right pad a string.
;
;SYNTAX           PadStr($Input,$Pad,$Length)
;
;PARAMETERS       $Input (Required) -  String value
;                 $Pad (Required) -  String value
;                 $Length (Required) - Integer (Max length of padded string)
;                 $PadSide (Optional) - String [L|R] Default is "L"
;
;REMARKS          The $Pad can be one or more characters. If the Padding exceeds
;                 the specified maximum length then the resulting string is trimmed
;                 preserving the original data.
;
;RETURNS          String
;
;DEPENDENCIES     KiXtart 4.02 or higher
;
;EXAMPLES         PadStr("401","0",8) result "00000401"
;                 PadStr("401","0",8,"R") result "40100000"
;
Function PadStr($Input, $Pad, $Length, optional $PadSide)
   Dim $i, $x
   $PadStr = ""
   $Input = "" + $Input
   $Pad = "" + $Pad
   $Length = 0 + $Length
   If $PadSide="" or Len($PadSide)>1 or Instr("LR",$PadSide)= 0
      $PadSide = "L"
   Endif

   $x = Len($Input)

   For $i=$x to $Length - 1 Step Len("$Pad")
      If $PadSide = "L"
         $Input = $Pad + $Input
      Else
         $Input = $Input + $Pad
      Endif
   Next
   If $PadSide = "L"
      $Input = Right($Input, $Length)
   Else
      $Input = Left($Input, $Length)
   Endif
   $PadStr = $Input
   Exit 0
Endfunction

---