I have hit a problem I haven’t been able to solve despite trying quite hard.
Basically I have created a PowerShell script to alter\change values in the HKU hive for a specific user on a remote Windows 10 Amazon WorkSpace. The script loads the hive and makes the changes perfectly but I am getting an error when trying to unload the hive. I have tried various methods as suggested on different forums but to no avail. Here is the part of the script I’m having trouble with:
$WorkSpace = “blahComputerName”
$PSS = New-PSSession -ComputerName $WorkSpace
$UserAcc = “XXXXX”
$SID = (Get-ADUser -server MyDomain.com -Identity $UserAcc).SID.Value
Invoke-Command -Session $PSS -ArgumentList $SID, $UserAcc -ScriptBlock {
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
reg load “HKU$($args[0])” “D:\Users$($args[1])\NTUser.Dat”
Clear-ItemProperty -Path
“HKU:$($args[0])\SOFTWARE\Microsoft\Office\Common\UserInfo” -Name
“UserInitials”
Start-Sleep -Seconds 5
reg unload “HKU$($args[0])”
Remove-PSDrive -Name HKU
}
Remove-PSSession -Id $PSS.Id
I have also read that using $SomeThing.Handle.Close() will close any open handles PowerShell might still have with the provider which might be causing the error but I can’t see how to use it in this context.
Here is the exact error:
ERROR: Access is denied. + CategoryInfo : NotSpecified: (ERROR: Access is denied.:String) , RemoteException + FullyQualifiedErrorId : NativeCommandError + PSComputerName : blahComputerName
I have manually observed the remote registry hive being loaded and then apparently unloaded but this error worries me and would like to solve it. I have proved that its reg unload “HKU$($args[0])” that is causing the error but cant find the correct solution.
It seems the hive is successfully unloaded when the PSSesion is removed (Remove-PSSession -Id $PSS.Id ) - not sure if it really is though and I would expect the correct method is the one I am attempting - reg unload “HKU$($args[0])”
The script runs with the required elevated privileges, so it’s not that. The remote WorkSpace is in a logged off state.
Any advice would be greatly appreciated. Thank You