Search code examples
c++windowsapiprofiles

How can I retrieve the Windows profiles directory path remotely?

I'm trying to retrieve the path of the profiles directory across various versions of Windows. In older versions that might be [drive]:\Documents and Settings, on newer ones it's [drive]:\Users. There are several ways to do this locally without a problem, however I need to find the path on a remote machine that I've connected to.

  • Remote Registry is enabled.
  • I have an impersonation token and can successfully gather information from the remote host via the Net API, etc.
  • I have access to the administrative share, and therefore all the files on the remote drive.

Here's a list of other important caveats.

  • It's a C++ project.
  • It doesn't seem to be possible for GetProfilesDirectory or GetUserProfileDirectory to operate in a remote context. If I'm wrong about this please let me know but in all my experiments the function has returned something from the local machine.
  • I can't use WMI, we tried many times to integrate WMI functionality into our project and it just didn't work.
  • I would prefer to do as little "screen scraping" as possible. If you have an idea that doesn't involve reading from some text file and parsing the result, I'd love to hear it. But I'd appreciate any useful answer really.
  • The profile directory information in the registry don't seem to be useful because it contains environment variables, and like GetProfilesDirectory, the environment variable expansion function does not seem designed for work with remote hosts. This means that the solution wouldn't work if I was making the call from a newer Windows machine to an older Windows machine or vice versa.
  • The solution should be general enough to work between hosts that might be running any version of Windows from Windows Server 2003 to Windows 7.

Thanks in advance for whatever ideas you might have. Ideally I'd just like to be able to force GetProfilesDirectory to operate on the remote host so if you know how to do that I'll love you forever.

Solution

  • If you have access to the remote registry, you should be able to look at the key where the profile directory and the profile list is kept:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList