0

Making changes to specific registry parts requires admin rights REGARDLESS if you have permission to edit these keys or value set explicitly. This means that if I want to make some changes to a very specific set of keys under very specific username that has been granted very specific rw permissions to these keys he still needs to be part of Admin group which defeats the point as admin group can now manage access easier than usual.

My grand idea is to restrict access to these registry keys only to this user, let the rest have read-only access and kick-off admin group. The problem is that I cant do the last because then my specific user rw means jack shit since he cant modify registry via either API or built-in Windows tools.

Is there a way for me to fine-tune this somehow?

Improve this question

1 Answer 1

Reset to default
0

Assuming Windows 10, no. Natively the user changing the registry must be a member of the Admin group.

Look at Power Broker for Windows (extension of Group Policy). This may be able to provide the granular permissions you need.

https://www.beyondtrust.com/press/powerbroker-windows-introduces-new-ways-help-security-teams-manage-access-policy-efficiently

Improve this answer
4
  • 404 - Not Found
    – Digika
    Jun 17, 2020 at 17:23
  • Thank you. They changed their link from the last time I used it and I fixed my post.
    – John
    Jun 17, 2020 at 17:29
  • Thanks. That suit is super-cool but total overkill. Any other options I have to completely prevent all users with admin right but userX to write to specific registry key? Including built-in accounts/groups. Is there way I can somehow protect/enforce it? Feel free to edit answer and I will edit question accordingly.
    – Digika
    Jun 17, 2020 at 17:31
  • This is the only way I know how to properly adjust Windows to give users specific permissions. Yes, it is a big business tool.
    – John
    Jun 17, 2020 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.