Getting network printers from remote user, can variable be used in path? - powershell

Question

I am getting the network printers from a remote user by getting the SID and querying the registry.
When I hard-code the SID in the path, it correctly displays the network printers for that user.
When I use a variable for the SID it fails with this error:
"Cannot find path '\HKEY_Users\Printers\Connections' because it does not exist. At line:18 char:7"
Here is the code:
# Get network connected printers from remote user by:
# 1) Connecting to computer name
# 2) Getting user and SID from AD
# 3) Query registry value
$MySAM = 'xyz1234'
$searcher = [ADSISearcher]"(&(objectClass=User)(objectCategory=person)(sAMAccountName=$MySAM))"
$user = $searcher.FindOne().GetDirectoryEntry()
# get binary SID from AD account
$binarySID = $user.ObjectSid.Value
# convert to string SID
$stringSID = (New-Object System.Security.Principal.SecurityIdentifier($binarySID,0)).Value
# computer name
$computer = 'xyz123456'
$Session = New-PSSession $computer -ErrorAction Stop # try to remote connect
Invoke-Command -Session $Session -ScriptBlock {
# works when SID hard-coded into path
# Get-ChildItem "Registry::\HKEY_Users\S-1-5-21-2009805145-1601463483-1839490880-13975\Printers\Connections"
# fails when using SID variable
Get-ChildItem "Registry::\HKEY_Users\$stringSID\Printers\Connections"
}
Remove-PSSession -Session $Session

Answer 1

In your question, you set $stringSID before connecting to the remote session. This means $stringSID will be blank on the remote machine since it's a (mostly) separate environment. However, you can specify that you want variables from your local session with the $Using:var scope. A good example is to try both out:
$Hello = 'Hello'
$World = 'World'
Invoke-Command -ComputerName RemotePC {
Write-Output $Hello $using:World
}
World
Another issue you may have have is the registry hive for other users may not get loaded in a remote session. We can fix it manually by LOADing it with the old REG tool. As a bonus, you can get the currently logged in user on the remote machine, and use their username instead of SID:
# example to get the currently logged-on user: (in DOMAIN\Username format).
# note: returns nothing if multiple users logged in (through RDP etc)
$LoggedOnUser = (Get-CimInstance -class Win32_ComputerSystem).username
# split the domain section of the username off:
$Username = ($LoggedOnUser -split '\\')[1]
# load the user's registry hive to an easy to find path:
REG LOAD "HKEY_USERS\$Username" "C:\Users\$Username\NTUSER.DAT"
# Now you can search their registry
Get-ChildItem "Registry::HKEY_USERS\$Username\Printers\Connections"