I need to open up and modify a user's registry key from a 32-bit service (note that the user is not logged in at the time.) I do the following:

Code:
//For simplicity error checks are not shown
//I also made sure to enable the following privileges:
// SE_RESTORE_NAME, SE_BACKUP_NAME

//"ntuser.dat" = is the file OS uses to load user's profile
RegLoadKey(HKEY_LOCAL_MACHINE, L"Test123", L"C:\\Users\\UserA\\ntuser.dat");

HKEY hKey;
DWORD dwRes = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
    L"Test123\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify"),
    NULL, KEY_READ | KEY_WOW64_64KEY, &hKey);

//'dwRes' = is returned as 2, or ERROR_FILE_NOT_FOUND

RegUnLoadKey(HKEY_LOCAL_MACHINE, L"Test123");
The problem is that the "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" key isn't loaded, even though I know that it exists in the actual user profile. I can verify that by loading the user account and by using 64-bit regedit.

I suspect that this has something to do with the Wow64 redirection but I can't seem to understand what am I doing wrong?