so, has anyone tried (I can't as I'm not on net now) to enum the keys HKU?
the logonname can be found in:
$name=readvalue("HKEY_USERS\"+$sid+"\Software\Microsoft\Windows\CurrentVersion\Explorer","logonname")
_________________________
!

download KiXnet