To my annoyance, Windows 10 has these items titled "Rotate right" and "Rotate left" in the context menu for many image files (such as .png and .jpg). I would prefer to get rid of these for all image file types, but I need to be able to do it in an automated fashion. I understand that I can manually remove these keys by using some external programs or possibly changing some permissions in the registry editor, but as I said, it needs to be automated. Further, these context menu entries should NOT come back whenever I restart the computer.

In the registry editor, I have found that:


seems to be the location of where these context menu entires are stored. So I tried to create a .reg file to automatically remove this key:

Windows Registry Editor Version 5.00


but to no avail, as running the .reg file does absolutely nothing. Even if I try to manually delete the key, Windows gives me the following error:

enter image description here

which clearly isn't helpful. From what I've read, however, even if people do somehow manage to delete this key, Windows may end up putting it right back as soon as the computer is restarted, which is definitely NOT the goal here.

So there's two things I would like to accomplish here:

  1. Have some kind of script (doesn't necessarily have to be a .reg file) to automatically remove these "rotate right / left" context menu entries.

  2. Make sure that they never ever come back.

Can this be done? If so, how?

  • have you tried any of the procedure below in these answers? – Biswapriyo Apr 27 '18 at 15:55

This is a short procedure. Download the SetACL tool from the the link given below. Copy the following commands in notepad and save it as a batch file (.bat or .cmd).

@echo off
set X="HKCR\CLSID\{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"
%~dp0\SetACL.exe -on %X% -ot reg -rec cont_obj -actn setowner -ownr "n:Everyone"
%~dp0\SetACL.exe -on %X% -ot reg -rec cont_obj -actn ace -ace "n:Everyone;p:full"
reg delete %X% /F

Place both the batch file and SetACL.exe in same folder. Run the batch file as administrator. The registry will be deleted.


  1. SetACL Home Page: https://helgeklein.com/setacl/
  2. SetACL Documentations: https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe/
  3. SetACL Download Page: https://helgeklein.com/download/
| improve this answer | |

First, you cannot change or delete that key without changing ownership because it uses TrustedInstaller credentials. It is not difficult to change using Regedit: right-click the key, click Permissions..., and click the Advanced button. Set yourself as owner, and Replace owner on subcontainers and objects. Then edit permissions so you can delete the key.

Change registry Ownership

Expect that on each major Windows update the original ownership and keys will be reasserted.

If you want to script the change, you'll need to use Powershell to do so. The following code is from the link above, and I have not tested it.

function enable-privilege {
  ## The privilege to adjust. This set is taken from
  ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
   "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
   "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
   "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
   "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
   "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
   "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
   "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
   "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
   "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
   "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
   "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
  ## The process on which to adjust the privilege. Defaults to the current process.
  $ProcessId = $pid,
  ## Switch to disable the privilege, rather than enable it.
  [Switch] $Disable
 ## Taken from P/Invoke.NET with minor adjustments.
 $definition = @'
 using System;
 using System.Runtime.InteropServices; 
 public class AdjPriv
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);  
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
  [DllImport("advapi32.dll", SetLastError = true)]
  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
  [StructLayout(LayoutKind.Sequential, Pack = 1)]
  internal struct TokPriv1Luid
   public int Count;
   public long Luid;
   public int Attr;
  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
  internal const int TOKEN_QUERY = 0x00000008;
  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
   bool retVal;
   TokPriv1Luid tp;
   IntPtr hproc = new IntPtr(processHandle);
   IntPtr htok = IntPtr.Zero;
   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
   tp.Count = 1;
   tp.Luid = 0;
   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
   return retVal;
 $processHandle = (Get-Process -id $ProcessId).Handle
 $type = Add-Type $definition -PassThru
 $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
enable-privilege SeTakeOwnershipPrivilege 
$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SOFTWARE\powertoe",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)
\# You must get a blank acl for the key b/c you do not currently have access
$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)
$me = [System.Security.Principal.NTAccount]"t-alien\tome"
\# After you have set owner you need to get the acl with the perms so you can modify it.
$acl = $key.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("T-Alien\Tome","FullControl","Allow")
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.