Enumerating the logged on user when running as system with Azure AD/Entra joined devices

Sometimes when running scripts in the system context with Intune we need to query the local user, whether that is the registry, or the local drive (Requirements scripts, detection scripts where you can’t switch to current user are a good example)

Using the environment variables won’t work at the system level as it will just return the system account. We also can’t use the traditional get-localuser command as the user doesn’t exist in the local users on the machine.

To make things easier, I’ve written a PowerShell function which will grab both the username and the SID of the logged in user for you to populate.

You can grab it from Github here, or copy from below

https://github.com/andrew-s-taylor/public/blob/main/Powershell%20Scripts/Intune/function-getloggedindetails.ps1

function getloggedindetails() {
        <#
    .SYNOPSIS
    This function is used to find the logged in user SID and username when running as System
    .DESCRIPTION
    This function is used to find the logged in user SID and username when running as System
    .EXAMPLE
    getloggedindetails
    Returns the SID and Username in an array
    .NOTES
    NAME: getloggedindetails
    Written by: Andrew Taylor (https://andrewstaylor.com)
    #>
    ##Find logged in username
    $user = Get-WmiObject Win32_Process -Filter "Name='explorer.exe'" |
      ForEach-Object { $_.GetOwner() } |
      Select-Object -Unique -Expand User
    
    ##Find logged in user's SID
    ##Loop through registry profilelist until ProfileImagePath matches and return the path
        $path= "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*"
        $sid = (Get-ItemProperty -Path $path | Where-Object { $_.ProfileImagePath -like "*$user" }).PSChildName

    $return = $sid, $user
    
    return $return
    }

Usage is like this:

$loggedinuser = getloggedindetails
$sid = $loggedinuser[0]
$user = $loggedinuser[1]

Remember when using the registry to stipulate you want to access it as HKU doesn’t exist

$Path = "Registry::HKU\$sid\SOFTWARE\7-Zip"

Hopefully you find this useful!