Load_HKEY_USER_Hive

Load_HKEY_USER_Hive

### Get SID of local Administrator
$localadmin = Get-LocalUser | where {$_.Name -like "Administrator"}

### Load HKEY_USER Hive of local Administrator
reg load HKU\$($localadmin.SID.Value) C:\Users\Administrator\ntuser.dat

### Check if 'RunOne' Key  is already available, if not create it
if(!(Test-Path -Path Registry::HKEY_USERS\$($localadmin.SID.Value)\Software\Microsoft\Windows\CurrentVersion\RunOnce)){
    New-Item -Path Registry::HKEY_USERS\$($localadmin.SID.Value)\Software\Microsoft\Windows\CurrentVersion\RunOnce
}

### Create RunOnce Variable und set Path to Powershell Script
Set-ItemProperty -Path Registry::HKEY_USERS\$($localadmin.SID.Value)\Software\Microsoft\Windows\CurrentVersion\RunOnce -Name '!SetRegion' -Value {c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy bypass -file "C:\Windows\Temp\SetRegion.ps1"}

### Unload HKEY_USER Hive of local Administrator
reg unload HKU\$($localadmin.SID.Value)

You may also like...