I'm trying to change permissions of some keys in HKCR (HKEY_CLASSES_ROOT) to get a misbehaving program working. I originally tried to script it, but realized that group policy can handle the change of permissions on registry keys. This works in my tests actually on keys in HKLM, but when I try to set perms on keys in HKCR, no workie. I know that there's no break between the client and AD with regard to group policy settings because as mentioned above, it does work for HKLM. Also, in rsop.msc on the client, it shows that the policy is in effect. I don't have any control over the choice of software, I have to use it. What am I missing?


  • I thought of that actually. There's actually no mechanism in Group Policy to modify permissions for the user. It's only available for the computer. Just wondering if it works for anyone else? Maybe it's just a problem on my machine. – user1197457 Apr 18 '13 at 21:26
  • Ok, next silly question. Have you tried applying them to HKEY_LOCAL_MACHINE\SOFTWARE\Classes instead of HKEY_CLASSES_ROOT? HKEY_CLASSES_ROOT is kind of like an database view that merges HKEY_LOCAL_MACHINE\SOFTWARE\Classes and HKEY_CURRENT_USER\Software\Classes. See the HKEY_CLASSES_ROOT section in support.microsoft.com/kb/256986. – Zoredache Apr 18 '13 at 21:57
  • That's true, I should have tried that. Cool thing is that I found out that it was a problem with the test machine in question. I found a vanilla windows virtual machine and retested with success. I saw errors with a registry hive not being able to unmount in the first test machine, and that's what got me to wondering if it was a problem with that machine. Thanks for your suggestions! – user1197457 Apr 18 '13 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.