3

I have this method to block registry keys and prevent accidental or deliberate deletion or rewriting, either by a user or by malware

example of keys:

"HKEY_CLASSES_ROOT\Applications\cmd.exe"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ComSpec"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\PATHEXT"

etc.

Protect keys: Create a c:\protect.txt with this content:

HKEY_CLASSES_ROOT\Applications\cmd.exe [2 19] 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe [2 19]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ComSpec [2 19]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\PATHEXT [2 19]

etc

And execute command

regini c:\block.txt

Question: How I can reverse these changes?

Important Note: What I want is a solution to automate the process with batch (a ".bat" to block and a ".bat" to reverse/restore original permission).. but first read or export keys permission to restore

Thanks a lot.

2 Answers 2

1

How I can reverse these changes?

You can reverse the changes by setting the permission entry is set to [1 17] which is Administrators Full Access and SYSTEM Full Access.

  1. Create a file (for example unblock.txt) with the following contents:

    HKEY_CLASSES_ROOT\Applications\cmd.exe [1 17] 
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe [1 17]
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ComSpec [1 17]
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\PATHEXT [1 17]
    
  2. Execute the unblock.txt script using the following command, run from an elevated (Administrator) cmd shell:

    regini unblock.txt
    

Notes:

  • The regini command must be run from an elevated (Administrator) cmd shell, otherwise it will fail (an no error will be displayed).

Further Reading

4
  • When I create a new registry key, it is created without administrative permissions (only special permits). In the case of existing keys (to avoid complicating the batch script), what I do is determine which permissions have these keys when you originally and restoration, rather than put to 1-17 key, I put the number corresponding to the original value of permits. Thanks
    – BrianC
    Jul 9, 2016 at 23:31
  • I would like to know the key permissions via cmd.exe
    – BrianC
    Jul 9, 2016 at 23:49
  • @brianc You need to find a copy of regdmp. Unfortunately regdmp is no longer downloadable from Microsoft.
    – DavidPostill
    Jul 9, 2016 at 23:51
  • Maybe with this i solved the problem.. testing. Thanks
    – BrianC
    Jul 10, 2016 at 0:07
0

You will reverse these changes the same way - only numbers at the end of every row will be different.

So please, plan good and carefully! (I always advise everyone to take pen and draw design on sheet of paper)

1) when you are making blocking, you must left at least one user/group with suficient, not blocked rights (full rights e.g.)

2) when you are making unblocking, you must doing it as that user/group, who have right to change those registry keys

If you want to know original rights (their numbers), you can use regdmp before any changes, you make.

1
  • Unfortunately regdmp is no longer downloadable from Microsoft.
    – DavidPostill
    Jul 9, 2016 at 23:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .