I need to lock down a Windows Vista Business PC. One of the requirements is that access to C:\Windows\System32\regedit.exe should be restricted to only (local) Administrators. This is a standalone PC that is not connected to ActiveDirectory or anything like that.
The default ACL permissions on this PC for regedit are:
regedit.exe D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;BA)(A;;0x1200a9;;;SY)(A;;0x1200a9;;;BU)S:AI
I tried changing the owner to Administrators and unchecking "Read and Execute" permission for the Users group. I figure that my user is still in the local Administrators group and they have "Read" and "Read and Execute" permissions for regedit.exe. However, when I try to open the file logged in as an admin user, I can no longer open regedit.exe, even when I right click open "Run as administrator". I get an error:
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
What am I misunderstanding about Windows Vista file access? What settings will allow a user in the Administrators group to open regedit.exe but no other users?