Use Win32_UserProfile.Loaded to check if user hive is loaded

- Query Win32_UserProfile by SID instead of Test-Path on registry
- Win32_UserProfile.Loaded property explicitly indicates hive status
- Added -Verbose:$False to suppress CIM query output
- Improved logging to show Loaded property value
This commit is contained in:
GraceSolutions
2026-05-04 10:55:12 -04:00
parent 30baf5e70e
commit bb1d0d7420
+7 -5
View File
@@ -491,14 +491,16 @@ Switch (Test-ProcessElevationStatus)
{ {
{($_ -eq $True)} {($_ -eq $True)}
{ {
#Check if user's registry hive is loaded under HKEY_USERS #Check if user's profile/registry hive is loaded via Win32_UserProfile
$UserRegistryBasePath = "Registry::HKEY_USERS\$($CurrentUserSession.SID)" $UserProfile = Get-CimInstance -ClassName 'Win32_UserProfile' -Filter "SID = '$($CurrentUserSession.SID)'" -ErrorAction SilentlyContinue -Verbose:$False
Switch (Test-Path -Path $UserRegistryBasePath -ErrorAction SilentlyContinue) Switch (($Null -ine $UserProfile) -and ($UserProfile.Loaded -eq $True))
{ {
{($_ -eq $True)} {($_ -eq $True)}
{ {
$WriteLogMessage.Invoke(0, @("Accessing certificate store for session user: $($CurrentUserSession.NTAccount) [SID: $($CurrentUserSession.SID)]")) $UserRegistryBasePath = "Registry::HKEY_USERS\$($CurrentUserSession.SID)"
$WriteLogMessage.Invoke(0, @("Accessing certificate store for session user: $($CurrentUserSession.NTAccount) [SID: $($CurrentUserSession.SID)] [Profile Loaded: $($UserProfile.Loaded)]"))
#Read certificates directly from user's registry hive #Read certificates directly from user's registry hive
$UserCertStoreNames = @('Root', 'CA') $UserCertStoreNames = @('Root', 'CA')
@@ -542,7 +544,7 @@ Switch (Test-ProcessElevationStatus)
Default Default
{ {
$WriteLogMessage.Invoke(1, @("User registry hive not loaded for SID: $($CurrentUserSession.SID). Skipping user certificates.")) $WriteLogMessage.Invoke(1, @("User profile not loaded for SID: $($CurrentUserSession.SID) (Win32_UserProfile.Loaded = $($UserProfile.Loaded)). Skipping user certificates."))
} }
} }
} }