Registry and AD Permissions¶
Files aren't the only things with permissions. Registry keys and Active Directory objects have access control lists too, and the same "too generous" flaw appears in both.
Registry¶
The registry is where policies live. A user with write access to a policy key can undo the policy from regedit.
(Get-Acl "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer").Access | Select IdentityReference, RegistryRights, IsInherited
Users should have ReadKey and nothing more on anything under Policies. Also check per-user keys that control the user's own restrictions, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.
Fix in regedit: right-click the key → Permissions → select the user or group → untick everything except Read.
Active Directory¶
On a Server 2022 domain controller, every user, group, and OU has an ACL. Covered in Active Directory; the short version:
dsacls "DC=corp,DC=local"
Look for Everyone, Authenticated Users, Domain Users, or a non-admin account with WRITE or FULL CONTROL. Remove with dsacls "<DN>" /R "<account>".