I'm trying to change permissions of some keys in HKCR (HKEY_CLASSES_ROOT) to get a misbehaving program working. I originally tried to script it, but realized that group policy can handle the change of permissions on registry keys. This works in my tests actually on keys in HKLM, but when I try to set perms on keys in HKCR, no workie. I know that there's no break between the client and AD with regard to group policy settings because as mentioned above, it does work for HKLM. Also, in rsop.msc on the client, it shows that the policy is in effect. I don't have any control over the choice of software, I have to use it. What am I missing?