Reg export works differently among "service" and "administrator"

Question

I tried "reg export" command in the script below

reg export "HKEY_CURRENT_USER\Control Panel\Desktop" xxx.reg

but the script work different action when it is worked by administrator or service. (When it is worked service(user is "nt authority\SYSTEM"), xxx.reg's registry is few than by admin)

I want to know how to get same registry by both "service" and "admin"...

Answer 1

That's because Administrator and service account are different accounts with different user hives. HKEY_CURRENT_USER is merely a shortcut to HKEY_USERS\S-1-5-21-... where S-1-5-21-... is the SID of the current user. If you want a task running under a service account to export data from another user's hive, you need to load that hive into the registry first and unload it afterwards:

reg load HKU\Temp C:\Users\username\ntuser.dat
reg export "HKU\Temp\Control Panel\Desktop" xxx.reg
reg unload HKU\Temp

You may also need to adjust permissions on the profile folders, because by default only the profile owner (i.e. the respective user) has access to a profile.