From ffdba21de1ac894282486d1cf9ca6d91141a0524 Mon Sep 17 00:00:00 2001
From: Copilot App <223556219+Copilot@users.noreply.github.com>
Date: Thu, 15 Oct 2026 07:16:09 -0700
Subject: [PATCH] Fix registry user hive filtering

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../AllRegistryUsers/AllRegistryUsers.psm1    | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/playbook/Executables/AtlasModules/Scripts/Modules/AllRegistryUsers/AllRegistryUsers.psm1 b/src/playbook/Executables/AtlasModules/Scripts/Modules/AllRegistryUsers/AllRegistryUsers.psm1
index abcf8fbc70..ace47ef8db 100644
--- a/src/playbook/Executables/AtlasModules/Scripts/Modules/AllRegistryUsers/AllRegistryUsers.psm1
+++ b/src/playbook/Executables/AtlasModules/Scripts/Modules/AllRegistryUsers/AllRegistryUsers.psm1
@@ -5,14 +5,23 @@ function Get-RegUserPaths {
     )
 
     $regPattern = 'Volatile Environment|AME_UserHive_'
-    if ($NoDefault) {$regPattern = "$regPattern[1-9].*"}
-    $initPaths = Get-ChildItem -Path "Registry::HKU" | Where-Object { $_.Name -match "S-[0-9-]+(?!.*_)|$regPattern" }
+    $defaultPathPattern = '(^|\\)\.DEFAULT$|(^|\\)AME_UserHive_Default$'
 
-    # If the 'Volatile Environment' key exists, that means it is a proper user. Built in accounts/SIDs don't have this key
+    $initPaths = Get-ChildItem -Path "Registry::HKU" |
+        Where-Object {
+            $keyName = $_.Name
+            $isUserHive = $keyName -match 'S-[0-9-]+(?!.*_)' -or $keyName -match 'AME_UserHive_'
+            $isDefaultHive = $keyName -match $defaultPathPattern
+
+            $isUserHive -and (-not ($NoDefault -and $isDefaultHive))
+        }
+
+    # If the 'Volatile Environment' key exists, that means it is a proper user. Built in accounts/SIDs don't have this key.
     $paths = @()
     if (!$DontCheckEnv) {
         foreach ($userKey in $initPaths) {
-            if ((Get-ChildItem -Path $userKey.PsPath | Where-Object { $_ -match $regPattern }).Count -ne 0) {
+            $hasUserMarker = Get-ChildItem -Path $userKey.PsPath | Where-Object { $_.Name -match $regPattern }
+            if ($hasUserMarker) {
                 $paths += $userKey
             }
         }
@@ -20,7 +29,7 @@ function Get-RegUserPaths {
         $paths = $initPaths
     }
 
-    return $paths
+    return @($paths)
 }
 
 Export-ModuleMember -Function Get-RegUserPaths
\ No newline at end of file