Change Permissions on Registry key via Command line

Question

I am trying to edit this registry key via the command line - been searching around for ages but can't find anything.

Really stuck at the moment so any help would be appreciated a lot. I do not mind using PowerShell or anything that calls a third party tool - just want to change it via the command line.

The reason is that local Administrators have Read only rights by default. I want to change this to Full Control. I can do it in the GUI in 2 seconds but command line is another matter.

HKEY_CLASSES_ROOT\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder

Answer 1

There is an excellent rundown of how to do it in PowerShell here.

Essentially, you can use Get-Acl and Set-Acl in PowerShell like you would for any other path.

$acl = Get-Acl HKLM:\SOFTWARE\stuff
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
    "Domain\user", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")

$acl.SetAccessRule($rule)
$acl |Set-Acl -Path HKLM:\SOFTWARE\stuff

Answer 2

Does RegIni.exe meet your needs? You can write a RegIni script that changes the permissions, and then call RegIni with the script as a parameter.

For example, if you wanted only administrators to have full access to that key, the script would look like this:

HKEY_CLASSES_ROOT\CLSID{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder [1]

Though presumably you would also want to grant the system access to the key, and perhaps read-only access to everyone else, in which case the security suffix would be

[1 8 17]

You can find the security suffix numbers in this table:

1  - Administrators Full Access
2  - Administrators Read Access
3  - Administrators Read and Write Access
4  - Administrators Read, Write and Delete Access
5  - Creator Full Access
6  - Creator Read and Write Access
7  - World Full Access
8  - World Read Access
9  - World Read and Write Access
10 - World Read, Write and Delete Access
11 - Power Users Full Access
12 - Power Users Read and Write Access
13 - Power Users Read, Write and Delete Access
14 - System Operators Full Access
15 - System Operators Read and Write Access
16 - System Operators Read, Write and Delete Access
17 - System Full Access
18 - System Read and Write Access
19 - System Read Access
20 - Administrators Read, Write and Execute Access
21 - Interactive User Full Access
22 - Interactive User Read and Write Access
23 - Interactive User Read, Write and Delete Access

And it goes without saying that you should have a good backup before playing with this for the first time, and maybe practice on a dummy registry key to avoid any unfortunate accidents.