Searching for Windows registry entries by permissions

Question

I recently went through and changed some registry entries so that only I had ownership and access. I suspect one or more of the changes resulted in a software installation failing. The installation program indicated it could not write a certain entry, but only identified the value to be written, not the location in the registry.

Unfortunately I made the mistaken of not keeping track of which ones I changed.

Is there some way to search through the registry to identify entries based on their permission? In my case, I would be trying to find entries owned only by me.

Answer 1

PowerShell can probably help. It'd be best if you could at least narrow things down to a few keys you were playing with. Because, searching from the root of the registry hive is probably going to produce so much noise that it'll not be much better than searching through the registry manually.

This will get all the keys where your username is set as the owner:

Get-ChildItem HKLM:\ -Recurse -ErrorAction SilentlyContinue | ? { $_.PSIsContainer -and (Get-Acl $_.PSPath).Owner -like '*username.here*' } | % { $_.Name }

(note that the asterisks are there intentionally as wild cards - you could also use -eq 'COMPUTERNAME\username' if you're confident you know the exact user name)

And, this will get all the keys that have non-inherited permissions:

Get-ChildItem HKLM:\ -Recurse -ErrorAction SilentlyContinue | ? { $_.PSIsContainer -and ((Get-Acl $_.PSPath).access | ? { ! $_.IsInherited }) } | % { $_.Name }

Answer 2

You can use Process Monitor (https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx) to log the actions of your failing installer. You can create a filter which would record only the Registry operations which result in an Access Denied failure.