Block use of Regedit in XP Pro

[DEI4ever]

I have a client that needs admin rights for everything but regedit..and he seems to like to go into the registry and play around. i need to stop this because he is creating more work for me
Is there anyway to block an admin account from using regedit?
thanks for the help

 

[craigey]

Couldn't you just rename the regedit.exe to something that the user won't think of? The only other way I can think of is to change their user status to a power user etc. Unfortunately there isn't any way of preventing the user doing something if he has admin rights. If you install a 3rd party app, to disable reg edit, then they can just uninstal the app, and so on.

 

[DEI4ever]

I tried renaming the regedit tool but Win XP just recreates it almost immediately after you rename it..
that was my first idea
any other ideas...
where does windows find the regedit.exe when you rename the old one?

 

[Lwanga]

Either assign a Group Policy for that specific user on your DC or on the users PC edit the local policy by typing gpedit.msc at the run command ( Local Computer Policy>User Configuration>Administrative Templates).

 

[DEI4ever]

This computer is not on a network or domain. It is a stand alone computer. The local policy has no option to block use of the regedit command..how can I add this in?

 

[bcastner]

Change the ACLs of the registry keys themselves.

Here is one way:

http://www.cae.wisc.edu/~micro/regperm/

 

[bcastner]

Or,

********* Begin cut and past Disable_regedit.reg ****

Windows Registry Editor 5.0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

***************  end Disable_regedit.reg *********
***************  end cut and paste area **********

Note: change both dword values to 0 to remove the restriction.

 

[Lwanga]

The local policy does have an option to block use of the regedit command. Local Computer Policy> User Configuration> Administrative Templates> System> Disable Registry Editing Tools - double click and check enabled