2

As far as i know, the user variables (of the currently logged on user) are stored in HKEY_CURRENT_USER\Environment. User path variables are stored in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders and the system variables are stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment. Thanks to this source

I am trying to read the environment variable %APPDATA% of all existing users. My python script is getting executed with system rights.

It is possible to read environment variables using os.environ(). But i did not find any documentation, which environment variables are read (the current logged on user variables or the system variables).

So is it possible to read the user path variables of all existing users?

Thanks for any help!

gies0r
  • 123
  • 5

1 Answers1

1

The registry key/value you need is:

Key: HKEY_USERS\[SID]\Volatile Environment\
Value: AppData  

So you would need to iterate through all of the currently loaded hives in HKEY_USERS for each SID.

Greg Askew
  • 34,339
  • 3
  • 52
  • 81