How to Block Everyone+Admin SID to Read+Write to a Registry Key

[meoit]

Hi all.

I using Access Control plugin to Block Read+Write to a Registry Key for Everyone and Admin Account
ex:

code:


!define Everyone_SID S-1-1-0

!define Admin_SID S-1-5-32-544

!define SYSTEM_SID S-1-5-18 ;NT AUTHORITY\SYSTEM



AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${Everyone_SID})" "FullAccess"

AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${Admin_SID})" "FullAccess"

AccessControl::ClearOnRegKey /NOINHERIT HKCU "Software\ABC" "(${SYSTEM_SID})" "FullAccess"

But it not working.

Please help me.

[Anders]

You probably have to deny, not just remove access.

[meoit]

Can you tell me the order to run the Access Control command.

[meoit]

Why not working ?

!define Everyone_SID S-1-1-0
!define Admin_SID S-1-5-32-544
!define SYSTEM_SID S-1-5-18 ;NT AUTHORITY\SYSTEM

Section BBB
AccessControl::GetCurrentUserName
Pop $R1
DetailPrint `GetCurrentUserName: $R1`
${If} $R1 == error
Pop $R1
DetailPrint `GetCurrentUserName error: $R1`
${EndIf}
;
AccessControl:enyOnRegKey HKCU "Software\ABC" "(${Everyone_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl:enyOnRegKey HKCU "Software\ABC" "(${Admin_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl:enyOnRegKey HKCU "Software\ABC" "(${SYSTEM_SID})" "QueryValue + SetValue + CreateSubKey + EnumerateSubKeys + ReadControl + GenericRead + GenericWrite + FullAccess"
Pop $R0
DetailPrint `DenyOnRegKey: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `DenyOnRegKey error: $R0`
${EndIf}
;
AccessControl::GetRegKeyOwner HKCU `Software\abc`
Pop $R0
DetailPrint `GetRegKeyOwner: $R0`
${If} $R0 == error
Pop $R0
DetailPrint `GetRegKeyOwner error: $R0`
${EndIf}
SectionEnd

[Anders]

What is not working, are you not seeing the changes in Regedit in the permissions dialog?

Keep in mind that this is just for show, you can never fully deny an admin, they always have the power to take ownership of any securable object.