Why cannot administrators delete registry keys when they run regedit as administrators?

Question

I am trying to completely remove McAfee from my Acer Aspire netbook. I downloaded MCPR.exe, and run it as an admin, in safe mode, but it fails to remove some registry keys. When I try to edit permissions for those keys, i get "permission denied", even though I am an admin, and run regedit as an admin. How should I remove those keys?

Answer 1

Right click on the Key in Question and select Permissions

Then click the advanced Button

Then click the Owner Tab, highlight your Admin account in the "Change Owner To" window, then tick the "Replace Owners on sub containers and objects" box and hit OK on all the open windows. closing all permissions windows.

Re open permissions on the same key and tick Full Control in the Allow column, hit OK

You should be able to delete the key now.

Answer 2

Registry keys have ACLs that dictate permissions just like files and folders in the file system. Being Administrator does not give you implicit permission to modify or delete keys - you must either use an account that has been granted these rights or change the permissions accordingly.

You may find that the owner of the McAfee keys is SYSTEM. Try to have the Administrator account take ownership of the key and then allow Full Control.

NB: Take care when making modifications to the registry and be sure about the purpose of the change. Always make a backup - it's better to take the time to have a recovery option.