Why is Powershell able to change registry values regardless of registry permissions?

1

1

Using Windows 8.1 Enterprise. Through Regedit I removed permissions from Administrators and even System for the key HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

I was under the assumption that that would prevent changes to any of these keys. Still though, through PowerShell, I was still able to change the value for ProxyEnable using the following command:

set-itemproperty -path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" ProxyEnable -value 1

Does PowerShell run as some super user or something without regard to permissions set up in Regedit?

King Holly

Posted 2015-08-02T06:43:04.947

Reputation: 11

1Just a silly question, did you remove the permissions using the same account that you're attempting to change them from? It's just that HKCU is a per-user key, so if you're using a different account it would explain the problem. – Petesh – 2015-08-02T09:55:42.477

Check the permissions via PowerShell to see if they look like what you are expecting: get-acl "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | format-list – dangph – 2015-08-03T03:35:44.310

Powershell always runs with – megamorf – 2015-08-03T14:09:22.073

Not a silly question at all. I think I apparently had a misunderstanding of HKEY_CURRENT_USER. I have an admin user and a non-admin account. I noticed my Internet Settings are messed up on the admin account since I completely removed permissions to Internet Settings keys. The non-admin account is fine though. I apparently was not actually editing the non-admin account I was trying to affect. I think that was the issue. Now I need to be careful when I actually apply the permissions to the non-admin registry. I will post back to here if I still see any issues. – King Holly – 2015-08-04T19:24:13.320

No answers