I need to lock down a Windows Vista Business PC. One of the requirements is that access to C:\Windows\System32\regedit.exe should be restricted to only (local) Administrators. This is a standalone PC that is not connected to ActiveDirectory or anything like that.
The default ACL permissions on this PC for regedit are:
I tried changing the owner to Administrators and unchecking "Read and Execute" permission for the Users group. I figure that my user is still in the local Administrators group and they have "Read" and "Read and Execute" permissions for regedit.exe. However, when I try to open the file logged in as an admin user, I can no longer open regedit.exe, even when I right click open "Run as administrator". I get an error:
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
What am I misunderstanding about Windows Vista file access? What settings will allow a user in the Administrators group to open regedit.exe but no other users?