Endpoint Administration Guide for Windows › Managing Resources › Windows Registry Protection › Protect a Windows Registry Entry

Protect a Windows Registry Entry

You can protect a Windows registry entry, and so provide additional protection to Windows operations.

To protect a Windows registry entry

1. If you want to use the REGKEY and REGVAL class records, ensure these classes are active An active class is one for which CA ControlMinder checks authorization whenever there is an access attempt on a resource in that class. If the class is inactive, access is permitted without any CA ControlMinder checks. You can manually set the state of a resource class to be active or inactive. . (They are active by default.)
2. Create a REGKEY or a REGVAL record with the name of the registry key or value you want to protect.

   Note: Use the full registry path name to specify the key or value. You can use a wildcard to specify all sub-keys or sub-key values that are nested under a key.

   The registry entry is now protected with the default access that CA ControlMinder provides for the record.

3. (Optional) Assign the users and groups, with their access authorization, to the appropriate access control list in the REGKEY or REGVAL record.

Example: Provide default access of NONE to a Registry Key

The following selang command provides default access of NONE to a registry key:

er REGKEY HKEY_LOCAL_MACHINE\SOFTWARE\Test\Key1 defacc(NONE) owner(nobody)

As a result, the default access to key1 is as follows:

Example: Provide default access of READ to a Registry Key

The following selang command provides default READ access to a registry key:

er REGKEY HKEY_LOCAL_MACHINE\SOFTWARE\Test\Key1 defacc(READ) owner(nobody)

As a result, the default access to Key 1 is as follows:

Example: Provide default access of NONE to a Registry Key Wildcard

The following selang command provides default access of NONE to all subkeys in a registry key:

er REGKEY HKEY_LOCAL_MACHINE\SOFTWARE\Test\Key1\* defacc(NONE) owner(nobody)

The wildcard (*) does not apply to Key1, but to all subkeys of Key1; this means that any form of access is denied to all subkeys of Key1. Access is also denied to rename or delete Key1, due to the parent protection rule.

This command permits access to the values of Key1. The access to values of subkeys of Key1 (for example values of Key1\subkey1\) varies between different Windows systems:

• On Windows Server 2003 and subsequent systems, this command denies access to enumerate the values of any subkey of key1, but grants access to create, rename, delete, and read the values.
• On systems earlier than Windows Server 2003, this command denies all access to the values of subkeys of Key1.

Example: Provide default access of NONE to a Registry Value

The following selang command protects a specific registry value with access NONE on Windows Server 2003 and subsequent systems:

er REGVAL HKEY_LOCAL_MACHINE\SOFTWARE\TestKey\value1 defacc(NONE) owner(nobody)

Note: On Windows Server 2008 and subsequent systems, CA ControlMinder returns a value of REG_NONE if an accessor tries to access a protected registry value with access NONE. A value of REG_NONE confirms that a value is present but does not specify what the value is.