Where does sysdm.cpl,EditUserProfiles get the data from?

Question

Running this command rundll32 sysdm.cpl,EditUserProfiles will display the 'User Profiles' window showing details about the profiles stored on that machine. The speed at which this screen loads suggests this data is stored somewhere locally versus generated on the fly.

I'm seeking to understand where this data located so it could be retrieved programmatically as querying Win32_UserProfile only provides a subset of the data, and I'm specifically looking for the profile size versus calculating it manually.

Answer 1

folder sizes aren't specifically stored anywhere as a variable, they are calculated when you right click -> properties on the 'c:\users' profile folder. Any location or subset data you need will be found in the registry under this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

If you need to collate a list of profile sizes, it would be best to query 'c:\users'. powershell would be my first go-to for this. Note also that the 'c:\users' location will only contain the complete profile if roaming profiles is not enabled and that you are not using a folder redirection policy, otherwise you would need to query the location they are stored in.

If you are interested in the powershell method, please see below link. This will detail how to use the folder-size module then you will just need to add in the folder name for identification. An off the shelf product which will be able to grab this for you is called 'spacesniffer' - run this againt your c:\users and it will provide you with a graph showing different shape sizes for each profile and you can even export that into a file if need be.

edit: forgot link https://www.gngrninja.com/script-ninja/2016/5/24/powershell-calculating-folder-sizes

spacesniffer: http://www.uderzo.it/main_products/space_sniffer/

Answer 2

Warning: The topic is too broad to explain in short Q&A. Those who are interested, go through the whole sysdm folder in ReactOS repository.

Here I sum up the procedure from Windows 10. I get the details from BOOL EditUserProfiles(HWND hWndParent) function in sysdm.cpl file.

1. It opens HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList registry key with RegOpenKeyExW() and enumerates all the sub-registry key in it.

2. ProfileImagePath registry value provides %UserProfile% folder path.

3. From that path, FindFirstFileW() gets last modified time and date.

4. Sid provides Security IDentifier. Each registered users has its own unique SID. From that SID value, LookupAccountSidW() provides user name, domain name etc.

5. Many more...