Re: Cannot Audit hkey_classes_root

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

For what it's worth; what you see in HKCR is a symbolic link to
HKLM\Software\Classes and HKCU\Software\Classes

The entries in HKLM are global to all users of the computer. What you see in
HKCU allows for unique customization of file type associations in the user's
profile. Entries in HKCU take precedence in the event of a duplication.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"SMS-Curious guy" wrote:
| Is it possible to set auditing on the registry key hkey_classes_root for
| server 2003? I notice that this is dimmed out if you select the key then
| Permissions, Security, Advanced, Auditing- It does not appear you can add
| anyone for auditing.
|
| Also I have noticed that if you wish to do full auditiong on the other
keys
| from the top folder to all the other subkeys for example
hkey_local_machine-
| you will receive a message that this could not be applied to some or all
| subkeys.


.

Relevant Pages

  • Re: Registry key controlled by deleted user
    ... what you see in HKCR is a symbolic link to ... Entries in HKCU take precedence in the event of a duplication. ... |I have multiple RealArcade keys in HKEY_CLASSES_ROOT that are controlled by ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: Removing duplicate entry on msconfig startup
    ... >delete the active startup command along with the duplicate. ... >>> lines differ only in that the active entries are lead by KKLM or HKCU, ...
    (microsoft.public.windowsxp.general)
  • Re: Audit Object Access Problem
    ... I am at a loss as to why you are seeing that many events if auditing of ... global objects is disabled and you are sure that no folders are enable for ... > I'm seeing thousands of entries per minute, ...
    (microsoft.public.win2000.security)
  • INF AddReg and DelReg under HKCU problem
    ... I'm having a problem with AddReg and DelReg entries under Vista ... this means that DirectX adds the OEMForceFeedback\CLSID value which references pid.dll. ... I add entries to HKLM and HKCU for the correct force feedback CLSID via an INF file, but the values in HKCU are not deleted / overwritten. ... It looks like it is added under .DEFAULT and S-1-5-18, not the registry location for the logged on user either HKCU or its corresponding entry under HKU. ...
    (microsoft.public.development.device.drivers)
  • Re: Register add-in to HKLM automatically
    ... This does what I want but it still places some entries into the HKCU ... Tab are in HKLM - Description, DisplayName, LoadBehavior, Company, ...
    (microsoft.public.vb.com)