Function GetUserProfileDirsFromRegistry(strComputer)
' Author  : Jakob H. Heidelberg
' Version : 1.1
' Usage   : arrProfilePaths = Split(GetUserProfileDirsFromRegistry(strComputer),"|")
' Returns : Text string of user profiles on the addressed computer, separated by PIPE char ("|").
'           Excludes profiles of the System, LocalService, NetworkService and the Local Administrator account
  On Error Resume Next
  Const HKEY_LOCAL_MACHINE = &H80000002
  Dim strReturn, arrSubkeys
  Dim objRegistry : Set objRegistry = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")
  Dim strKeyPath : strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
  Dim strValueName : strValueName = "ProfileImagePath"
  objRegistry.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubkeys
  For Each objSubkey In arrSubkeys
    strSubPath = strKeyPath & "\" & objSubkey
    If objSubkey = "S-1-5-18" Then
     ' This is the System profile/SID - leave alone!
    ElseIf objSubkey = "S-1-5-19" Then
     ' This is the LocalService profile/SID - leave alone!
    ElseIf objSubkey = "S-1-5-20" Then
     ' This is the NetworkService profile/SID - leave alone!
    ElseIf Left(objSubkey,9) = "S-1-5-21-" And Right(objSubkey,4) = "-500" Then
     ' This is the builtin Administrator account profile/SID - leave alone!
     ' If you want to hit the Local Admin also, just comment the above ElseIf Statement
    Else
     ' This must be a "normal" users profile/SID
     objRegistry.GetExpandedStringValue HKEY_LOCAL_MACHINE, strSubPath, strValueName, strValue
     strReturn = strReturn & strValue & "|" 'Set PIPE char for SPLIT
    End If
  Next
  Set objRegistry = Nothing
  strReturn = Left(strReturn,Len(strReturn)-1) 'Get rid of the last PIPE char (|)
  GetUserProfileDirsFromRegistry = strReturn 'Return value of function
End Function