regdmp to export Registry key permissions?

Posted on 2014-08-15
Last Modified: 2014-08-15
So I'm trying to make a batch script that will modify some values in HKEY_CLASSES_ROOT\CLSID\
Problem is I need to script the modification of permissions on said keys before changing the value.

I'm told this can be done by dumping the permissions with regdmp with desired permissions, then importing via regini.
The problem is, regdmp is not giving me any thing regarding permissions on a key.

When I run the command:
regdmp \registry\machine\software\classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder
It just lists the sub types and their values. it doesn't list any kind of permission representation.
Am I missing a parameter here or is there a better way?
Question by:garryshape
    LVL 82

    Accepted Solution

    Use setacl.exe,
    To give the user or group "Name" full permissions on this key, try this (but maybe create a key "HKLM\Software\Acme" for testing):
    SetACL.exe -on "HKLM\Software\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder" -ot reg -actn ace -ace "n:DOMAIN\Name;p:full"

    Open in new window

    Note that if you're on a 64bit system, you should use the 64bit version of SetACL, especially if the key you want to change is the 'real' (64bit) "HKLM\Software"; a 32bit software (like regini!) on a 64bit system will only see the 32bit part, which is actually "HKLM\Software\Wow6432Node".

    Author Comment

    Thanks, I came across that but wasn't sure if it was legit.  
    I am seeing some PowerShell options here with Get-ACL and Set-ACL I'm fiddling with too. It might work since I'm dealing with Windows 7 and SCCM Task Sequence supports powershell commands.
    LVL 82

    Assisted Solution

    Yes, SetACL is legit.
    And I love Powershell, but Set-ACL leaves something to be desired as far as intuitive usability (espacially in environments without access to MSDN) is concerned. In your case, it should be comparatively simple, assuming you want to give full control:
    $Account = "SomeDomain\SomeName"
    $Key = "HKLM:\Software\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder"
    $ACL = Get-ACL -Path $Key
    $RegistryAccessRule = New-Object -TypeName System.Security.AccessControl.RegistryAccessRule -ArgumentList $Account, "FullControl", "Allow"
    Set-Acl -Path $Key -AclObject $ACL

    Open in new window


    Author Closing Comment

    Ok great, ty, works great!

    Author Comment

    So for name would it be "NT AUTHORITY\SYSTEM" if I wanted to give the System account the access? SCCM 2012 OSD Task Sequence runs commands as System so that's why I ask.
    LVL 82

    Expert Comment

    Yes, either that, or just "SYSTEM".

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    How to remove superseded packages in windows w60 or w61 installation media (.wim) or online system to prevent unnecessary space. w60 means Windows Vista or Windows Server 2008. w61 means Windows 7 or Windows Server 2008 R2. There are various …
    I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
    Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
    This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.

    794 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now