Is it possible to prevent a certain program from accessing the Windows registry? I know there are ACLs to lock out a user, but what about per-executable control?
asked Jun 24, 2016 at 16:31
-
2Nope, because it's the account that the program's process is running as that writes to the registry on its behalf. Which program is it that's you're trying to block? What registry keys are you trying to stop it writing to? Depending on what part of the registry you're trying to prevent writing to, you could potentially just deny everyone. But to me, this smells like an XY Problem; what's the ACTUAL problem you're trying to solve by blocking the registry writes?– Ƭᴇcʜιᴇ007Jun 24, 2016 at 16:38
-
In linux you can apply Mandatory Access Control mechanisms to apps via systems like SeLinux and AppArmour, but in windows everything is user based. see here for more details: msdn.microsoft.com/en-us/library/windows/desktop/…– Frank ThomasJun 24, 2016 at 17:05
-
@Ƭᴇcʜιᴇ007 True. There is Mandatory Access Control in Windows too, and Low integrity may be helpful here.– Ben NJun 25, 2016 at 1:20
Add a comment
|
3 Answers
Sorry, that's not possible, at least not to the extent you seem to want. As mentioned in the comments by Ƭᴇcʜιᴇ007, all of Windows access control is based on users. Every process has a token attached to it, which determines what user it's running as. There is no difference between you performing an action and a program running under your account performing that action, since you do literally everything through one process or another. "Programs don't attack users; users attack users."
Besides, virtually every process accesses the Registry. Even if the program itself doesn't explicitly do any Registry access, an examination with Process Monitor reveals that every GUI app starts with a boatload of Registry reads to figure out how to set up the graphical controls. Run Process Monitor on an app you think doesn't need the Registry; you'll be surprised.
But if you want to block all writes and only writes, there actually is something that may help. Windows has a concept of "integrity levels", a part of UAC. Basically, a program running at a certain integrity level can't write to objects labeled with a higher integrity level. Normal processes and normal files (and Registry keys) have the Medium integrity level, but you can manually launch processes with the Low level. Download the PsExec tool. If you wanted to create a command prompt that can't write to normal places, run this:
psexec -l -i cmd
The -l switch sets Low integrity; the -i switch makes the process interactive. The resulting command prompt can only write to places specifically marked as Low integrity.
C:\Users\Ben>reg add HKCU\Test
ERROR: Access is denied.
That command works in a normal command prompt, but not this kind of locked-down one.
Another solution is to use Sandboxie. This program can execute any process inside sandbox, so that any change to the system made by that process can be undone.
answered Jun 29, 2016 at 13:36
Go to the folder that program wrote in the registry (HCU/HLM..\Run) like: "C:\Users\aaa\AppData\Roaming\BloatInstall\Annoying.exe"
Rename that program to a new name, like: "Annoying.exe" -> "noMoreAnnoying.exe"
Create then a folder with the former name in the same directory "Annoying.exe" (an empty folder)
Change your shortcut so it targets the new executable file name: "C:\Users\aaa\AppData\Roaming\BloatInstall\noMoreAnnoying.exe"
You won't need to edit the Windows Registry anymore. When that program tries to auto-start, it won't be able to.
