Skip to content

Instantly share code, notes, and snippets.

@goyuix
Created July 30, 2014 02:57
Show Gist options
  • Star 10 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save goyuix/fd68db59a4f6355ee0f6 to your computer and use it in GitHub Desktop.
Save goyuix/fd68db59a4f6355ee0f6 to your computer and use it in GitHub Desktop.
PowerShell to mount default NTUSER.DAT, modify it and unload it
Write-Host "Attempting to mount default registry hive"
& REG LOAD HKLM\DEFAULT C:\Users\Default\NTUSER.DAT
Push-Location 'HKLM:\DEFAULT\Software\Microsoft\Internet Explorer'
if (!(Test-Path Main)) {
Write-Warning "Adding missing default keys for IE"
New-Item Main
}
$sp = Get-ItemProperty -Path .\Main
Write-Host "Replacing $_ : $($sp.'Start Page')"
Set-ItemProperty -Path .\Main -Name "Start Page" -Value $site
Pop-Location
$unloaded = $false
$attempts = 0
while (!$unloaded -and ($attempts -le 5)) {
[gc]::Collect() # necessary call to be able to unload registry hive
& REG UNLOAD HKLM\DEFAULT
$unloaded = $?
$attempts += 1
}
if (!$unloaded) {
Write-Warning "Unable to dismount default user registry hive at HKLM\DEFAULT - manual dismount required"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment