HOWTO: Reference Another User's Hive By Means Of HKEY_CURRENT_USER

MORE INFORMATION

The registry key HKEY_CURRENT_USER is a mapping to the HKEY_USERS\User SID key. The system will perform the mapping based on the security context of the running thread accessing HKEY_CURRENT_USER, but the mapping is not dynamic. In other words, as a thread changes security contexts through impersonation, the mapping of HKEY_CURRENT_USER to HKEY_USERS\User SID does not change automatically.

This non-dynamic nature of HKEY_CURRENT_USER can sometimes cause problems when multiple users are impersonated in the same application. The best solution is to directly access the HKEY_USERS\User SID, rather than using HKEY_CURRENT_USER. This approach does not depend on the mapping and therefore you can be sure of exactly which user's hive you are referencing. This approach is highly recommended for service applications that may impersonate many people.

Application developers frequently do not have full control over all code. Therefore, to force HKEY_CURRENT_USER to access the correct user's hive, a running thread can call RegCloseKey(HKEY_CURRENT_USER) to close the current mapping of HKEY_CURRENT_USER before impersonating another user. The very next call to RegOpenKey that references HKEY_CURRENT_USER will re-map to point to the new user's hive.

NOTE: Make sure that no other running thread is still accessing the current mapping of HKEY_CURRENT_USER when RegCloseKey() is called, otherwise there is a race condition and the thread accessing HKEY_CURRENT_USER could cause the HKEY_CURRENT_USER to HKEY_USERS mapping to access the wrong user's hive or -- even worse-- to access a closed user's hive.