Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to lock down a Windows Vista Business PC. One of the requirements is that access to C:\Windows\System32\regedit.exe should be restricted to only (local) Administrators. This is a standalone PC that is not connected to ActiveDirectory or anything like that.

The default ACL permissions on this PC for regedit are:

regedit.exe D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;BA)(A;;0x1200a9;;;SY)(A;;0x1200a9;;;BU)S:AI

I tried changing the owner to Administrators and unchecking "Read and Execute" permission for the Users group. I figure that my user is still in the local Administrators group and they have "Read" and "Read and Execute" permissions for regedit.exe. However, when I try to open the file logged in as an admin user, I can no longer open regedit.exe, even when I right click open "Run as administrator". I get an error:

Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

What am I misunderstanding about Windows Vista file access? What settings will allow a user in the Administrators group to open regedit.exe but no other users?

share|improve this question
    
+1 - cool question. –  Doc Jul 6 '11 at 15:24

2 Answers 2

up vote 2 down vote accepted

Well... unless you lock down the whole machine, anything like this will simply not work.

There are hundreds of third party tools out there that allow registry editing.

If however you just want the basic disable access to regedit protection, open Registry Editor and navigate to HKEY_CURRENT_USER \ Software \ Microsoft \ CurrentVersion \ Policies and create a Dword with name DisableRegistryTools and value of 1.

And done!

share|improve this answer

Unfortunately, you cannot do this for the whole registry itself, but put all the users you do not want to have access into a new group, then give that group the "deny" permission to that regedit.exe program, and anything else you don't want them to touch. Deny will overrule any other permissions you have previously set. You may restrict them too much it you do it on certain folders, and "break" some programs, so test it if you do that.

Since it will inherit the permissions, you will need to go to advanced and uncheck that, then when prompted, click copy. This copies the inherited permissions, but makes them originate there.

As pointed out, this will not stop a knowledgeable user, but will stop most.

If you really need to lock down a computer for a specific user, I recommend this program (It is pretty amazing really):

http://www.fortresgrand.com/products/f101/f101.htm

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.