winapi to read or copy NTUSER.DAT (locked file)

user_19438467 0
Viewed 92

I am trying to load NTUSER.DAT of logged-in local user in registry hive to read their keys from my program running as admin (it has got SeDebugPrivilege, SeBackupPrivilege, etc).

It works when the user is logged-out, and doesn't work when they are logged-in.

The error is:

Error: (32) The process cannot access the file because it is being used by another process

So, is there any Win32 API, or another way, I can copy NTUSER.DAT or read it without relying on a third-party library? I need to do this when they are logged-in.

Shadow Volume Copy copies the whole drive, hence it isn't feasible. Maybe it is possible to unmount their registry hive and then load it using RegLoadKeyA() or something?

winapi c windows c++
1 Answers

I found a workaround, when the user is logged-off you can load NTUSER.DAT of that user in registry, then read key. if the user is logged-in, you can read their keys from HKU/user-sid

user_194384670
Related