Re: Problems creating keys under the HKEY_LOCAL_MACHINE in Windows XP

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: MikeD (nobody_at_nowhere.edu)
Date: 11/05/04 

Date: Thu, 4 Nov 2004 19:51:18 -0500

"Richard Boehme" <boehme@newsgroups.nospam> wrote in message
news:uMRMDNpwEHA.4028@TK2MSFTNGP15.phx.gbl...
> Randy Birch wrote:
>
> > Lower the access rights ... it is very rare you need to grant
KEY_ALL_ACCESS
> > to a user. And you do know that technically user data should be tracked
> > under the HKCU key rather than HKLM?
> >
>
> It's stored under HKLM because it has to be common to all users.
KEY_ALL_ACCESS is for the purposes of, for now, making sure that the user
definitely
> has any permissions needed. It will be more restrictinve later.

Unfortunately, it doesn't appear you understand exactly what KEY_ALL_ACCESS
is for (or does). If the user doesn't have permissions for a particular
Registry key (as granted by the Windows Group the user is a member of or has
explicitly been granted the proper permissions by some other means) then
KEY_ALL_ACCESS will *not* grant those permissions. This is why Randy
suggested to lower the access rights you're requesting. If you specify
KEY_ALL_ACCESS and the user is not an Admin, the API call to open the
Registry key will fail because only admins have unrestricted access to the
Registry. However, if you specify lower rights, such as KEY_READ, then the
key can be opened by a non-admin (assuming the user still has read
permissions granted to him/her for that key). IOW, you are requesting
certain access rights for that particular key, not granting rights. The
user must already have the proper permissions for the rights you're
requesting.

I remember when Win2000 first came out and people were switching from Win98
to Win2000. This caused all kinds of problems for programmers who didn't
know better because under Win98 there was no problem requesting
KEY_ALL_ACCESS since, for all intents and purposes, Win98 has no security.

On another note, perhaps the Registry is not even the best place to be
saving this data. A file which all users have access to (for example,
located on a shared network folder) might be much better.

Mike

Relevant Pages

  • Re: Problems with security issues
    ... Some programs need to have stronger access rights. ... permissions durring the installation. ... setup the permissions based on the strong name of the application. ...
    (microsoft.public.dotnet.framework)
  • Re: HELP! - IE Registry Hacked
    ... Login with local admin rights and "Take ownership" of this key using ... As key owner you can change its access rights ... Derek O'Harrow píše v diskusním ... Reassign the appropriate permissions. ...
    (microsoft.public.win2000.registry)
  • Re: HELP! - IE Registry Hacked
    ... Login with local admin rights and "Take ownership" of this key using ... As key owner you can change its access rights ... Derek O'Harrow píše v diskusním ... Reassign the appropriate permissions. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Problems with security issues
    ... Your application can only do what your user has permissions to do. ... need to describe these in the installation manual, ... > varying access rights. ... > How do you grant an application access rights. ...
    (microsoft.public.dotnet.framework)
  • Re: Prevent changes to Administrator password
    ... What I am trying to do is give Taz1972 some options to minimize the risk or make it harder for a lower-level DA to reset the password for the EA account. ... Restricted Admins group to mitigate against what you propose Deji. ... also need to make sure the DAs in question cannot elevate their rights to EA, ... > By adding the Deny Write Permissions ACE, ...
    (microsoft.public.windows.server.active_directory)