Windows registry - need to give permissions

[shadowwebs]

Currently got an issue at work where I need to setup 3 different users permissions to be the same, for arguments sake let's call them Bob, Jean & Julie.

There's an application installed on the PC which stores data in the registry under a specific software name under "hkey_current_user\software\developer name\application"... unless the user has full control permissions to this route, they have to enter the configuration details everytime they logon to the PC, as it loses the detail when they log off.

Bob & Jean's settings work fine, however for Julie it keeps on dropping the setting.

I have tried setting the registry permissions with full control as 'everyone', as well as for their specific domain\username. I have also tried setting them as local administrators on the PC.

When Julie logs on, if I do Win+R and enter regedit, it says this has been blocked by an administrator and doesn't allow to access. This is really the first hurdle, as if you can help me get them access to the registry then I should be able to work out the rest from here.

I was expecting this to be more straightforward than it has been so far... from a frustrated IT Techy.

Thanks

 

[Layback Bear]

I'm no registry expert but I'm trying to understand your post.

Are you saying you have administrator rights and can't enter into the registry?

Go to the Start and type in regedit and then right tick on the regedit.exe that pops up and select Run as Administrator.

 

[shadowwebs]

yes it works as local administrator, but not for Julie who is a standard user that I've added in to the local administrators group on the PC.

just tried with Julie's login on another PC and it works fine... so I get a feeling the registry is corrupt somewhere from all the changes attempted.

 

[Layback Bear]

Is it possible to use a restore point before all this happened would solve your problem?

 

[shadowwebs]

the PC has been reimaged a couple of times but has made no difference, it stores the data fine for two of the users in the hkey_current_user area of the registry but for the third user it doesn't store any of the data.

am i right in thinking therefore all it should take is for the particular key to be set for read & write access for this third user for it to work?

 

[Layback Bear]

Well I'm sure I don't know how to help you.

Questions

Why is it necessary to enter the registry under Julie to give Julie permission to use a program?

Why do you need to enter the registry to give Julie permission to use a program?

Is this program installed on the domain/network server?

***I going to the ranch and see if I can find you some help from other members.
Hang in there because of time zones and work loads it takes a little while at times.

 

[shadowwebs]

The software is installed locally, and it needs set configuration settings which are stored in hkey_current_user\software.... but if the user doesn't have permissions to this folder, it loses the settings each time they log off and back on again. Does that help?

 

[NoelDP]

UI don't think that what is proposed here can work, as the whole of the HKCU key is generated on the fly by Windows at every login from a combination of the Default User and Logged-in User hives.
To me, this mechanism means that the permissions would be reset on every login, no matter what you do to them in the meantime.
All I could suggest would be to create a script to do the permissions changes required, and set that to run on login using a Scheduled Task.

 

[shadowwebs]

ok, I did export the reg keys and added to the startup folder for this user that needs them, however, I found that each time they logon rather than it just importing or asking if they want to import, it comes up with the message access denied to the registry... or something along these lines.

again... it doesn't quite make sense that it works for some users but not others, when they all have same permissions.

 

[Layback Bear]

Thanks Noel for coming to help.

 

[NoelDP]

The problem is probably because changes to the registry will require using elevated permissions - which is why I suggested using Scheduled Tasks for the job, as you can run the script under either the user permissions, or under the Administrator account - or under the System account

 

[shadowwebs]

Noel, apologies for needing to ask... any chance you can guide me through how to do this or point me to an article on how to do this?

It's only on one particular PC and only for one particular user, where I either need on each login for the system to populate data in to the registry under hkey_current_user, or for it to at least remember the data which was already there the last time they logged on. I'm guessing it'll be easier to setup a scheduled task to add the data in, rather than try to back date to whenever they last logged on?

I appreciate everyone's help with this.

 

[NoelDP]

This should help...
You are being redirected...

 

[shadowwebs]

thank you - now I need to write a batch file... so i'll do some reading up on that.

 

[shadowwebs]

guessing that in order to add a reg key even through a batch file is going to require permission to access the registry for this particular user... so that kind of brings us back to step one of the problem, even if going through a scheduled task then will it work without regedit permissions?

 

[shadowwebs]

okay, now at this point I feel like I am simply leaving myself breadcrumb notes to myself... you can ignore any waffling that I now do.

 

[NoelDP]

You can use the REG ADD command to add registry values/keys - yes, it would have to be in an Elevated context.

 

[Pyprohly]

Hi Shadowwebs,

To what degree of certainty do you suspect that Julie is precisely experiencing a permission issue?

It would help if we all could view the access rights that each of the users Bob, Jane and Julie have for this registry key in question. A comparison can then be made to determine if the problem does relate to a permission issue or not.

For each of the users, login as that user and run the following command in a PowerShell shell,

(Get-Acl 'HKCU:\Software\[COLOR="Red"]Developer\ProgramName[/COLOR]') | fl

What are the outputs for each user?

 

[shadowwebs]

I've managed to resolve this, well, up to a certain point, so I found that all network user accounts work fine and remember the details, other than Julie's... so it's got to be a corrupt network profile, going to be resetting the profile tonight and will see what happens from there on.

 

[Layback Bear]

Keep us posted on the results. But I'm somewhat confused because you stated that the program was installed on local computer. At least that is my understanding.
I asked this question in post #6.

Is this program installed on the domain/network server?

Your post #7

The software is installed locally, and it needs set configuration settings which are stored in hkey_current_user\software.... but if the user doesn't have permissions to this folder, it loses the settings each time they log off and back on again. Does that help?

I will just keep watching and learning.