Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to edit this registry key via the command line - been searching around for ages but can't find anything.

Really stuck at the moment so any help would be appreciated a lot. I do not mind using PowerShell or anything that calls a third party tool - just want to change it via the command line.

The reason is that local Administrators have Read only rights by default. I want to change this to Full Control. I can do it in the GUI in 2 seconds but command line is another matter.

share|improve this question

There is an excellent rundown of how to do it in PowerShell here.

Essentially, you can use get-act and set-act in PowerShell like you would for any other path.

$acl = Get-Acl HKLM:\SOFTWARE\stuff
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("Domain\user","FullControl","Allow")
$acl |Set-Acl -Path HKLM:\SOFTWARE\stuff
share|improve this answer
thanks for that - the problem I face is that if I am an administrator and I want to change the permissions on a key that has Administrators as READ - it will say access denied....really annoying. I will try the powershell thing out and come back. System is also Read so can't use psexec to do it. – lara400 Nov 15 '11 at 15:48
@lara400 Then you need to take ownership of the key before you can assign write permissions. Nothing in the world will let someone with only read make modifications. That defeats the purpose of the read ACE. I suggest that you open a new question asking for to take ownership of a registry key in PowerShell. – MDMarra Nov 15 '11 at 15:52

Does RegIni.exe meet your needs? Basically, you write a small RegIni script that changes the permissions, and then call RegIni with the script as a parameter.

For example, if you wanted only administrators to have full access to that key, the script would look like

HKEY_CLASSES_ROOT\CLSID{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder [1]

Though presumably you would also want to grant the system access to the key, and perhaps read-only access to everyone else, in which case the security suffix would be

[1 8 17]

If you look at this page, it tells you what the various values mean.

And it goes without saying that you should have a good backup before playing with this for the first time, and maybe practice on a dummy registry key to avoid any unfortunate accidents.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.