How to Block Everyone+Admin SID to Read+Write to a Registry Key

meoitDecember 15, 2022 at 6:50 AM#

How to Block Everyone+Admin SID to Read+Write to a Registry Key

Hi all.

I using Access Control plugin to Block Read+Write to a Registry Key for Everyone and Admin Account
ex:



!define Everyone_SID S-1-1-0

!define Admin_SID S-1-5-32-544

!define SYSTEM_SID S-1-5-18 ;NT AUTHORITY\SYSTEM



AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${Everyone_SID})" "FullAccess"

AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${Admin_SID})" "FullAccess"

AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${SYSTEM_SID})" "FullAccess"

But it not working.

Please help me.

AndersDecember 15, 2022 at 10:00 AM#

You probably have to deny, not just remove access.

meoitDecember 19, 2022 at 1:27 AM#

Can you tell me the order to run the Access Control command.

meoitDecember 19, 2022 at 10:32 AM#

Why not working ?

!define Everyone_SID S-1-1-0
!define Admin_SID S-1-5-32-544
!define SYSTEM_SID S-1-5-18 ;NT AUTHORITY\SYSTEM

Section BBB
AccessControl::GetCurrentUserName
Pop $R1
DetailPrint `GetCurrentUserName: $R1`
${If} $R1 == error
Pop $R1
DetailPrint `GetCurrentUserName error: $R1`
${EndIf}
;
AccessControl:😁enyOnRegKey HKCU "Software\ABC" "(${Everyone_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl:😁enyOnRegKey HKCU "Software\ABC" "(${Admin_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl:😁enyOnRegKey HKCU "Software\ABC" "(${SYSTEM_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl::GetRegKeyOwner HKCU `Software\abc`
Pop $R0
DetailPrint `GetRegKeyOwner: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `GetRegKeyOwner error: $R0`
${EndIf}
SectionEnd

AndersDecember 19, 2022 at 4:23 PM#

What is not working, are you not seeing the changes in Regedit in the permissions dialog?

Keep in mind that this is just for show, you can never fully deny an admin, they always have the power to take ownership of any securable object.