Hi,
Is there a way to remove SYSTEM and Administrators FullAccess right from a Registry Hive with AccessControl Plugin?
Cheers
Carsten
AccessControl Plugin and Registry Permission
5 posts
Short answer: No.
Long answer: it depends on what the goal of this is, what do you need to do that requires this change? The FullAccess right is designed for program protection, so that programs that don't need to write to those locations can be run without Administrator Privileges. The SYSTEM requires full access, otherwise the system can't write registry entries and some system settings will no longer "stick", also Windows probably won't be able to install its updates either.
Long answer: it depends on what the goal of this is, what do you need to do that requires this change? The FullAccess right is designed for program protection, so that programs that don't need to write to those locations can be run without Administrator Privileges. The SYSTEM requires full access, otherwise the system can't write registry entries and some system settings will no longer "stick", also Windows probably won't be able to install its updates either.
From a registry hive, no probably not.
You can remove it from a registry key by setting a new ACL but administrators can always take ownership of securable objects so there is nothing you can do to stop an administrator that knows what they are doing from getting access if they really want it...
See also:
https://blogs.msdn.microsoft.com/old...4-00/?p=19263# What is the terminology for describing the various parts of the registry?
You can remove it from a registry key by setting a new ACL but administrators can always take ownership of securable objects so there is nothing you can do to stop an administrator that knows what they are doing from getting access if they really want it...
See also:
https://blogs.msdn.microsoft.com/old...4-00/?p=19263# What is the terminology for describing the various parts of the registry?
Hi,
thanks for your replies. I know that an administrative user can regain access to the keys i just want to block a registry hive for a setup, because Citrix recommends this (http://support.citrix.com/article/CTX120618)
Could you help me with the syntax to block inheritance and set all users to read access?
Thank you and cheers
Carsten
thanks for your replies. I know that an administrative user can regain access to the keys i just want to block a registry hive for a setup, because Citrix recommends this (http://support.citrix.com/article/CTX120618)
Could you help me with the syntax to block inheritance and set all users to read access?
Thank you and cheers
Carsten
DisableRegKeyInheritance + ClearOnRegKey with GenericRead + GenericExecute for (WD) and perhaps GrantOnRegKey to give (BA) WriteDAC rights.
IMHO it is much better to just deny write access for (WD), it is less destructive and makes it easy to restore the ACL.
IMHO it is much better to just deny write access for (WD), it is less destructive and makes it easy to restore the ACL.