0

I have searched for quite a while on a solution to this. At least I think I understand the problem, but I have yet to come to any solution.

What I need is either some sort of executable or a script that will delete some registry entries. The problem is that the registry entries in question only give read/write access to SYSTEM and no one else. The only way that I can delete them is by going into regedit, setting myself as the owner, and finally setting full control to everyone. Only then can the keys be deleted. I need this process to be in some sort of script though!

So in C#, I first make sure that the software has administrative rights. Then I try to execute the following.

    RegistryKey reg_localmachine = RegistryKey.OpenRemoteBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, "");
    RegistryKey key = reg_localmachine.OpenSubKey(@"SYSTEM\path to subkey", true);

On the second line, when I try to access the sub key with write access, I get the exception "Requested registry access is not allowed." In order for me to change owner or grant permissions, I need to execute SetAccessControl() on the RegistryKey. In order to set access control, I need write privileges for the key. So I am in this paradox.

Tails86
  • 507
  • 5
  • 19
  • You can do the same thing programmatically that you are doing manually. You need to explicitly take ownership of the registry key in order to be able to delete it. Any application running with administrative privileges (i.e., elevated) should be able to do this. – Cody Gray - on strike Apr 16 '13 at 03:30
  • I had the following bookmarked, but I'm not sure why I dismissed it as an option. http://stackoverflow.com/questions/15321394/delete-stubborn-registry-key Is using the suggested Windows API in arx's answer the only way to explicitly take ownership? I am going look into that solution. – Tails86 Apr 16 '13 at 16:44

1 Answers1

1

Security is there for a reason.

You don't want any old program to be able to come in and start hacking around in the registry.

Each entry in the registry has it's own set of DACLS. There are only two solutions:-

  1. Change the account under which your program is running to an account that has permission to delete the registry entry.

  2. Change the DACLS on the registry entry to include the account your program is running under.

Mick
  • 6,527
  • 4
  • 52
  • 67