Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support loading windows user registry hive directly from ntuser.dat file #5221

Open
AdamVB opened this issue Feb 14, 2025 · 0 comments
Open
Labels
enhancement New feature or request

Comments

@AdamVB
Copy link

AdamVB commented Feb 14, 2025

Is your feature request related to a problem? Please describe.
All the checks that rely on registry values being set under
HKEY_USERS{SID}
can effectively only work when a user is "logged in" e.g. their hive is "loaded"
Once a user logs out all entries under HKEY_USERS{SID} are "unloaded"
Some customers have windows systems where users aren't logged in during scan time, so all of these checks will not produce any results.
If we could load the user hive from NTUSER.DAT on our own we can run the checks without having to rely on a user being logged in.
Windows essentially loads C:\Users<username>\ntuser.dat on login too, so we'd be doing the same

Describe the solution you'd like
Ideally this would extend the registry resource, maybe under a different property? Something that can load ntuser.dat for each user?

Describe alternatives you've considered
There isn't really an alternative to this, other than having checks fail or return no result

@AdamVB AdamVB added the enhancement New feature or request label Feb 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant