One of the things userinit.exe does while loading your user profile is to check for an environment variable called UserInitMprLogonScript. We can use this environment variable to assign a logon script to a user that will get run when logging into the machine. The variable isn't set by default, so we can just create it and assign any script we like.

Notice that each user has its own environment variables; therefore, you will need to backdoor each separately.

Let's first create a reverse shell to use for this technique:

To create an environment variable for a user, you can go to its HKCU\Environmentin the registry. We will use the UserInitMprLogonScript  entry to point to our payload so it gets loaded when the users logs in: