This might sound crazy, but why don't you try to make the scan of HKCU work, at least for domain users?
I had to do this right now in Autoit, and it works:
1 - using function LookoutAccountSid, I get the current logged on SID
2 - the current logged on user can be read depending on the OS:
- for x64 from HKLM64\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI, LastLoggedOnUser
- for x86 from HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\, AltDefaultUserName
Then you scan the HKU\SID\ part. Does this make any sense to be implemented? If you ask me, yes it does. 🙂
Thanks