WinBatch Tech Support Home

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch
Networks - Servers
Microsoft Client
wNT
plus
Services

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

wntAccessMod Registry Issue

Question:

I have a registry key, that has been stripped of all permissions. I am logged in as an administrator, and must replace the permissions with the parents permissions (inheritance).This code seems to work, but only if I run it twice. If I duplicate the function wntAccessMod, it works. Why does it not work the first time? 
AddExtender("WWWNT34I.DLL")
myReghandleParent = RegOpenKey(@REGMACHINE, "SOFTWARE\Classes\KBMap")
myReghandle = RegOpenKey(myReghandleParent , "DefaultIcon") ;The key with no permissions
users = wntAccessList("", myReghandle, 400, 0)
If StrIndexNC(users, "System", 1, @FWDSCAN) == 0 || StrIndexNC(users, "Users", 1, @FWDSCAN) == 0 || StrIndexNC(users, "Administrator", 1, @FWDSCAN) == 0
	myreturn = wntAccessMod("", myReghandleParent, 400, 1, 0) ; This one fails
	If myreturn == 1 Then Message("Change done", "Done")
	TimeDelay(3)
	myreturn = wntAccessMod("", myReghandleParent, 400, 1, 0) ; This one works
	If myreturn == 1 Then Message("Change done", "Done2")
EndIf
RegClosekey(myReghandle)
RegClosekey(myReghandleParent)
Info: 
Winbatch 2005C
NT extender 39008.0.0.1
Windows XP SP2
To replicate the Reg Key with missing permissions, perform the following on the sub key.
  1. Right click the key and do permissions
  2. Click advanced
  3. Uncheck ' Inherit from parent ----'
  4. At the security prompt, click remove.
  5. Click OK
  6. Click Yes at prompt
  7. Click OK

Answer:

v39020 is the latest release of the NT extender. Just to make sure that the problem wasn't already fixed, can you re-run your test using the latest build? The reason that I mention this is that there were some low-level security fixes imlemented relating to handling registry key security in one of the more recent release and the fixes might also address this problem, too

In terms of the procedure you posted, it looks like you're setting up a classic "Catch-22" scenario. You've removed all the ACEs in the DACL [Discrtionary ACL, a.k.a. "the permissions"]. The result is that *NOBODY* has rights to access the key using normal security. Only the owner of the object retains any control at all, and only to re-write the DACL. So, the underlying steps that need to be performed is to take ownership of the key using wntOwnerSet() and, at the same time, choose to "Zap" the DACL/permissions. Finally, use wntAccessMod() to re-enable ACL inheritance on the key. This only works on *LOCAL* registry keys. If you're accessing a registry key on a remote system, you can't do the part with wntAccessMod(). 

Article ID:   W17071

File Created: 2007:07:03:14:28:04
Last Updated: 2007:07:03:14:28:04