RE: "Requested registry access is not allowed." and performance co

Hi Steven. Thanks for the reply. Had a server-down situation, so it took me
a couple of days to get back to this...

After some inspection with RegMon it would appear that the ASPNET account
also needs full control over HKLM\System\CurrentControlSet\Services. I tried
several advanced permissions options, like "this key only" and "Set Value"
and "Create Subkey"; but could only get it to work if I can the ASPNET
account full control over HKLM\System\CurrentControlSet\Services--which
doesn't give me a warm-and-fuzzy.

Doing that gets rid of the "Requested registry access is not allowed"
exception text. The process gets further, by creating the
Performance-counter--related sub-keys in
HKLM\System\CurrentControlSet\Services; but,
PerformanceCounterCategory.Create now raises a Win32Exception with Message
property equal to "The handle is invalid" or ErrorCode == 0x80004005.

--
http://www.peterRitchie.com/


"Steven Cheng[MSFT]" wrote:

Hi Peter,

Thank you for posting here.

From your description, you're dynamically creating
PerformanceCounter/Category in your ASP.NET webservice's code, however,
you're euncountering smoe security exception against the registry accessing
at runtime, correct?

Based on my experience, there does exists some issues regarding on the
ASP.NET idenitity doesn't have sufficient permission for accessing certain
registry entry. For your scenario, your ASP.NET application is running on
XP box, by default the ASP.NET process idenitity is the machine\ASPNET
account, however, I'm wondering whether you've used any other security
related setting in IIS or ASP.NET such as impersonation which could change
the default process idenitity of ASP.NET. You can verify this in your web
application, and here is a kb article introduce the ASP.NET process
identity:

#Process and request identity in ASP.NET
http://support.microsoft.com/?id=317012

Also, since the security exception is still complaining about the registry,
I suggest you use the regmon tool to trace the registry accessing failure,
this tool is very good at capturing reigstry access problem:

http://www.sysinternals.com/utilities/regmon.html

BTW, to help make the troubleshooting simplifed, I suggest you keep your
ASP.NET application running as "Fulltrust" mode(this is the default mode if
you haven't explicitly change the Trust level in your machine.config or
web.config).

Hope this helps.

Regards,

Steven Cheng
Microsoft MSDN Online Support Lead


==================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.



Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights
.

Relevant Pages

  • Re: registry hacked under XP limited account
    ... >> The thing I want to know is that the registry can be modified ... Running as limited account does VERY LITTLE to stop ... running with administrative rights is a VERY BAD HABIT. ... This tactic will NOT be effective against future malware. ...
    (microsoft.public.security)
  • RE: Moving user account from NT to Win2k3
    ... I found that there is no "Shared icon" under folder in the tree ... After importing the registry successfully, you may want to restart the ... When creating a new user account, the SID of the account has been ... Microsoft Online Partner Support ...
    (microsoft.public.windows.server.migration)
  • Re: Can you back up mail account settings in Outlook 2007?
    ... Thank you for clarifying about the registry key paths etc. ... its original factory settings, in order to determine whether an issue I have ... Outlook Express did- but it is not the same program as Outlook. ... two letters of every password for every account on both profiles. ...
    (microsoft.public.outlook)
  • Dear Patti
    ... Can I Load/Register Them into my Registry ?? ... for EXAMPLE I dont have ... Add Remove Windows Components ... When I log off and i go and log on the Adminstrator Account,, That Problem Is Not There!! ...
    (microsoft.public.windowsxp.newusers)
  • Re: How do I find out if Im the system administrator for my perso
    ... registered as the system administrator for this machine. ... password when I'm installing new software and under some other ... I was never asked to establish an administrator's account or password ... The reason for my question is that I'm about to have to edit my registry ...
    (microsoft.public.windowsxp.security_admin)
Loading