Skip to content

Registry and AD Permissions

Files aren't the only things with permissions. Registry keys and Active Directory objects have access control lists too, and the same "too generous" flaw appears in both.

Registry

The registry is where policies live. A user with write access to a policy key can undo the policy from regedit.

(Get-Acl "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer").Access | Select IdentityReference, RegistryRights, IsInherited

Users should have ReadKey and nothing more on anything under Policies. Also check per-user keys that control the user's own restrictions, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.

Fix in regedit: right-click the key → Permissions → select the user or group → untick everything except Read.

The HKLM hive itself

The server STIG (WN22-00-000170) also wants the top of HKEY_LOCAL_MACHINE at its defaults: SECURITY readable only by SYSTEM (Administrators have a special right to change permissions and nothing else), and SOFTWARE and SYSTEM with Users at Read, Administrators and SYSTEM at Full Control, plus CREATOR OWNER and ALL APPLICATION PACKAGES entries. Check the three quickly:

foreach ($k in 'SECURITY','SOFTWARE','SYSTEM') { "== HKLM\$k"; (Get-Acl "HKLM:\$k").Access | Select IdentityReference, RegistryRights }

Everyone, Users with FullControl or SetValue, or a named user anywhere in that output is a change someone made. Use regedit → Permissions on the key to remove the entry.

Active Directory

On a Server 2022 domain controller, every user, group, and OU has an ACL. Covered in Directory Permissions; the short version:

dsacls "DC=corp,DC=local"

Look for Everyone, Authenticated Users, Domain Users, or a non-admin account with WRITE or FULL CONTROL. Remove with dsacls "<DN>" /R "<account>".

Try it

  1. Give Users write on a policy key in regedit, read it with Get-Acl, then fix it.
  2. On a DC practice VM, run dsacls on the domain root and read the output.

Build it

A registry permission check for the Policies keys, appended to ntfs-audit.ps1.

Next

Backups