

Then deletes the main keys and subkeys.Copies the main keys and subkeys into backup registry directories.Present when the user User is not logged in. Registry hive HKU (hive key Users) because normally the keys are not Loads the user User definition from C:\Users\User\NTUSER.DAT into the.

cmd are stated on the "Target" field when looking at the properties of the link with right-click/properties. exe stored in \System32 from HP (hidewin.exe) to which the. So in administrative tools are these 2 links, and those actually run an. Whoami /user (when logged as the user User)Ĭontrol panel - administrative tools - "disable user security" and "enable user security" C:\Windows\System32\unsecure_user.cmd

Let me share few more details when I have already spent my time playing with this. The SID is the SID of the user User account - yours will be different except of the last "-1000." (backup of the main key - right click -> export)
