title: Remote registry change HKCU using only cmd and psexec
body: <p>Hi everyone I am lost...</p>
  
  <p>I have admin rights.</p>
  
  <p>I want to modify registry key in HKEY_CURRENT_USER\Software.... on remote PC where another user is logged.</p>
  
  <p>I don't want to use PowerShell because we don't have remote registry enabled.</p>
  
  <p>I am stuck with cmd</p>
  
  <p>Therefore I use PSexec. </p>
  
  <p>If I want to change something in global HKLM its pretty easy</p>
  
  <pre><code>psexec \\COMPUTERNAME reg add HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\...... /t REG_DWORD
  </code></pre>
  
  <p>since I call the psexec as admin it allows me to change anything in HKLM on the remote machine</p>
  
  <p>but when I need to change something in HKCU I need the SID of the user to plug it into HKEY_USERS\SID\SOFTWARE\ and that's where I hit a wall...</p>
  
  <p>I tried something like this (it didn't work, the syntax is probably all wrong)</p>
  
  <pre><code>psexec \\COMPUTERNAME for /F "skip=1 tokens=1" %%i in ('query user') do set varusername=%%i
  </code></pre>
  
  <p>this was supposed to get remote logged users name into variable 'varusername' to later use it to get SID</p>
  
  <p>something like this (again the syntax is probably wrong):</p>
  
  <pre><code>psexec \\COMPUTERNAME wmic useraccount where name='%varusername%' get sid
  </code></pre>
  
  <p>this completely blew up since wmic on the remote computer when executed as admin (via psexec) doesn't see the same users as query user...</p>
  
  <p>here is the output of the respective commands</p>
  
  <p><strong>query user</strong> give me the logged user name 'johndoe'</p>
  
  <p>USERNAME     SESSIONNAME     ID     STATE    IDLE     TIME    LOGON TIME</p>
  
  <p>johndoe      console      1        Active        none      9/10/2018 5:27</p>
  
  <p><strong>wmic useraccount get name, sid</strong> does not see the 'johndoe' at all</p>
  
  <p>Name            SID</p>
  
  <p>DefaultAccount  S-1-5-21-3285310242-2953612481-1302521585-503</p>
  
  <p>defaultuser0    S-1-5-21-3285310242-2953612481-1302521585-1002</p>
  
  <p>LocalAdmin      S-1-5-21-3285310242-2953612481-1302521585-500</p>
  
  <p>Guest           S-1-5-21-3285310242-2953612481-1302521585-501</p>
  
  <p>so as you can see I hit the wall</p>
  
  <p><strong>query user</strong> gives me logged user on remote PC "johndoe" but I have no way to get SID of "johndoe" using <strong>wmic useraccount</strong> to plug it into:</p>
  
  <pre><code>psexec \\COMPUTERNAME reg add HKEY_USERS\SID\SOFTWARE\Microsoft\...... /t REG_DWORD
  </code></pre>
  
  <p>any ideas how to get around this?</p>
  
  <p>I just need to edit HKCU on remote PC for a currently logged user without using PowerShell</p>