I have this method to block registry keys and prevent accidental or deliberate deletion or rewriting, either by a user or by malware
example of keys:
"HKEY_CLASSES_ROOT\Applications\cmd.exe"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ComSpec"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\PATHEXT"
etc.
Protect keys: Create a c:\protect.txt with this content:
HKEY_CLASSES_ROOT\Applications\cmd.exe [2 19]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe [2 19]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\ComSpec [2 19]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment\PATHEXT [2 19]
etc
And execute command
regini c:\block.txt
Question: How I can reverse these changes?
Important Note: What I want is a solution to automate the process with batch (a ".bat" to block and a ".bat" to reverse/restore original permission).. but first read or export keys permission to restore
Thanks a lot.