How to get the user names and domains of all locally stored user profiles?

Question

How do I retrieve the user names and domains of all user profiles stored on a computer?

Here's a screenshot of the User Profiles manager to illustrate what I mean:

Answer 1

The profiles are mapped by SID. The mapping is stored in this registry key:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList]

You can use WMI to enumerate the SIDs and resolve them to user and domain name:

Const HKLM = &h80000002
Const profiles = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

Set wmi = GetObject("winmgmts://./root/cimv2")
Set reg = GetObject("winmgmts://./root/default:StdRegProv")

reg.EnumKey HKLM, profiles, subkeys
For Each sid In subkeys
  Set acct = wmi.Get("Win32_SID.SID='" & sid & "'")
  WScript.Echo acct.ReferencedDomainName & "\" & acct.AccountName
Next

If you're looking for the user/domain of existing profile folders only, check if the ProfileImagePath value inside the subkeys points to an existing folder:

Const HKLM = &h80000002
Const profiles = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

Set sh  = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set wmi = GetObject("winmgmts://./root/cimv2")
Set reg = GetObject("winmgmts://./root/default:StdRegProv")

reg.EnumKey HKLM, profiles, subkeys
For Each sid In subkeys
  reg.GetStringValue HKLM, profiles & "\" & sid, "ProfileImagePath", path
  path = sh.ExpandEnvironmentStrings(path)
  If fso.FolderExists(path) Then
    Set acct = wmi.Get("Win32_SID.SID='" & sid & "'")
    WScript.Echo acct.ReferencedDomainName & "\" & acct.AccountName
  End If
Next