Endpoint Integration Guide › Endpoint Hardening › Apply Registry Permissions

Apply Registry Permissions

On CA DLP endpoints, you can make the following registry changes:

HKEY_LOCAL_MACHINE\Software\CA DLP

This registry key contains machine-wide settings written only by the installer and the CA DLP infrastructure service.

You can apply permissions to this key using Regedt32 to prevent access by unauthorized users. The SYSTEM (Local System) account requires full access.

HKEY_CURRENT_USER\Software\CA DLP

This registry key contains housekeeping information, written by the runtime integration components and the consoles.

HKEY_CLASSES_ROOT

The install process registers COM servers and file extensions under the HKEY_CLASSES_ROOT registry hive and other integration settings under HKEY_LOCAL_MACHINE\Software\Microsoft registry key.

Important: Tampering with these registry values can jeopardize the integrity of the installation. We do not recommend restrictive permissions here. We strongly recommend that this registry key retains Read access for all user types.

Registry Changes for Endpoint Agents

When you install a CA DLP browser and email endpoint agent, the installer makes changes to the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  \Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Extensions\Wgn