NT Registry Permissions

[dkehoe]

When installing an application (using the Wise Install Program) logged on as the local administrator to the local NT machine

We have the problem that certain active X components (created in VB6) are registered but with the permissions in the registry only giving access to the local administrator.

When a user logs in they get error messages (can't create active X component etc.)

Using the regmon tool we have identified that this is due to ACCESS DENINED on the registry

There are lots of registry settings so identifying these manually is a pain especially since we are installing on many machines

We know that if we give the user full access to all the registry it's OK but this is not acceptable from a security point of view


Are there any NT setting (policy etc.) that could effect the way the registry is updated?

 

[HEX1000]

make the user(s) a member of the local power user group.
use regedt32 and assign poweruser group 'change' permissions to the HKLM and HKCU.

 

[sultan]

We have had similar problems for certain software and have used the following methods to resolve them:

1) For simple software such as Autocad 2002, we would get "Error Accessing Registry" messages. This was solved by adding the PC name to the Power User Group (Win2K Control Panel-> Administrative Tools -> Group -> Add User name)

2) More complex software required providing "READ" permission to the registry key "Winreg" (on dbase server for example). (Note: Deleting this key allows anyone to READ/WRITE to the registry of the server. So don't delete it, just add user permissions to it).

The steps are:
Run regedt32
HKEY_LOCAL_MACHINE -> System -> CurrentControlSet -> Control -> SecurePipeServers
Select "winreg" and goto top menu Security->Permissions
Add the user name with READ permission.

Good Luck,

Sultan