The Big Picture: Locks on the Folders
Imagine the filing cabinet from Section 1 has a lock on every folder. Some folders anyone may read. Some only the office manager may change. A few can be opened only by the building's owner.
Registry keys work the same way. Every key has permissions that say who may do what. This is how Windows stops a normal program (or a virus running as you) from breaking the whole PC by editing the wrong key.
WHO TRIES KEY RESULT
You (standard user) ──► HKCU\Software\... allowed (your own data)
You (standard user) ──► HKLM\SOFTWARE\... read only; write blocked
Administrator (elevated) ► HKLM\SOFTWARE\... allowed
Administrator ──► HKLM\SAM\SAM\... blocked; only SYSTEM
6.1 ACLs on Registry Keys
What it is: An ACL (Access Control List) is the list of rules attached to a key. Each rule is an ACE (Access Control Entry) that says: "this person or group is allowed (or denied) this kind of access."
The pieces:
| Word | Meaning | Everyday picture |
|---|---|---|
| Security principal | A user, a group, or a built-in account such as SYSTEM | The name on the list |
| Permission | The action allowed, such as Read or Full Control | What that name may do |
| ACE | One line: who + allow/deny + which permission | One line on the list |
| ACL | All the lines for one key | The whole list |
| Owner | The account that controls who else gets access | The manager |
| Inheritance | A subkey copies the rules of its parent unless told otherwise | A subfolder obeying the folder's rules |
This is the same security system that protects files and other Windows objects. Keys simply use it as well.
Common permissions on a key:
| Permission | Allows |
|---|---|
| Query Value | Read a value |
| Set Value | Change or create a value |
| Create Subkey | Make a new key inside |
| Enumerate Subkeys | List the keys inside |
| Notify | Ask to be told when the key changes (Section 11) |
| Delete | Delete the key |
| Read Control / Write DAC / Write Owner | See, change, or take over the permissions themselves |
regedit groups these into simple choices: Read and Full Control.
Typical default rules on important keys (details can vary by key, so treat this as a guide):
| Place | SYSTEM | Administrators | Users (standard) |
|---|---|---|---|
HKLM\SOFTWARE | Full Control | Full Control | Read only |
HKLM\SYSTEM | Full Control | Full Control | Read only |
HKLM\SAM, HKLM\SECURITY | Full Control | Very limited (or none by default) | None |
HKCU (your own hive) | Full Control | Full Control | Full Control for the owner (you) |
Look at them yourself (view only). In regedit:
- Click a key, for example
HKEY_LOCAL_MACHINE\SOFTWARE. - Right-click it and choose Permissions....
- A window lists the groups at the top. Click each group and read the Allow and Deny boxes below.
- Click Advanced to see inheritance and the owner.
- Close the window with Cancel, not OK, so nothing is changed.
Allow and Deny. A Deny rule overrides an Allow rule for the same person. This is powerful and risky: a wrong Deny on Everyone can lock even you out of a key.
PowerShell can read the ACL too:
Get-Acl "HKLM:\SOFTWARE" | Format-List6.2 Why Some Keys Require Admin/SYSTEM Access
What it is: Different parts of the registry are protected at different levels, because damage to them has different results.
The three levels of access you will meet:
| Level | Who | Typical reach |
|---|---|---|
| Standard user | A normal account | Read most of HKLM; write only their own HKCU |
| Administrator (elevated) | An admin who clicked Yes at the UAC prompt (UAC = User Account Control, the dialog that asks permission) | Write most of HKLM |
| SYSTEM | The operating system's own account | Everything, including SAM, SECURITY and some HKLM\SYSTEM parts |
Why a standard user cannot write to HKLM. HKLM controls things for everybody: drivers, services, installed programs, security. If any program running as you could change them, a single piece of malware (or a bug) could:
- Add itself to start with every user
- Replace a driver or service with a harmful one
- Turn off the firewall or antivirus settings
- Break Windows so it cannot boot
By limiting writes to HKLM to administrators, Windows makes sure such a change needs a conscious approval (the UAC prompt). Your own HKCU is yours, so changing it only affects you.
Why even administrators are sometimes blocked.
- Not elevated. An admin account normally runs programs with a limited "filtered" token. Only after approving UAC does the program get the full admin rights. If you run
regeditnormally and try to change an HKLM key, it fails or asks for approval. - SAM and SECURITY. These hold account secrets. Windows allows only SYSTEM to open them.
- Protected by the owner "TrustedInstaller". Some keys under
HKLM\SYSTEMandHKLM\SOFTWAREbelong to a special service account called TrustedInstaller, which is used by Windows Update and servicing. Even administrators cannot change those keys unless they first take ownership. Do not do this lightly. - Services and drivers have their own accounts. For example, a service may be allowed to write to its own key only.
- Security software. Some products and policies (Section 8) also guard keys of their own.
What happens when you are denied. regedit shows an error such as "Error Writing Value" or "Cannot edit", and a program using the API gets a return value of ERROR_ACCESS_DENIED (code 5).
Windows tip: start regedit with admin rights only when needed. Right-click it and choose Run as administrator, make the single change you need, then close it. Do not leave it open elevated.
Do not "fix" permission errors by giving Everyone Full Control. It makes the problem go away but opens a hole every program on the PC can use. If a program fails because of permissions, find out why first (Section 7 shows one common reason).
Summary
| Topic | Remember this |
|---|---|
| ACL | The rules on a key: a list of ACEs |
| ACE | One rule: who, allow or deny, which permission |
| Inheritance | Subkeys copy their parent's rules by default |
| Default rules | SYSTEM and Administrators write HKLM; Users read only |
| HKCU | You can change your own, without admin rights |
| Why HKLM is protected | It affects every user and boots the PC |
| SAM / SECURITY | Only SYSTEM by default |
| TrustedInstaller | Owner of some Windows keys; blocks even admins |
| View permissions | regedit → right-click → Permissions (then Cancel) |
| Do not | Give Everyone Full Control to fix an error |