Remotely reading HKLM registry key

Posted: 11-06-2006, 07:16 PM
I have been successful in reading the registry on remote Vista systems --for
the most part. I have no trouble reading the HKCU keys. I can read most of
the HKLM keys. However, I have found that some of the HKLM keys are not
accessible for reading. For example, I can read any value within the
following remote registry key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

But if I try to read any value within this remote registry key it fails with
a permission error (5):

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Another example...

I can enumerate all of the remote registry keys below the following key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

But I cannot enumerate all of the remote registry keys below this key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

I have checked the permissions of the keys in question and I see no
difference between the keys I can read and the keys I cannot read.
Obviously, I am admin on both machines or I wouldn't even have been able to
read the remote keys that I am able to read. I have insured that when I
access the keys that I pass only KEY_READ as the access parameter. This
issue only occurs when reading the keys remotely. If I run my program on the
local Vista system in question I have no issue reading ANY key within HKLM.

Does anyone have a clue as to why only specific HKLM keys are being blocked
and how to overcome that?

Any input would be helpful.

JW


Reply With Quote

Responses to "Remotely reading HKLM registry key"

Gerry Hickman
Guest
Posts: n/a
 
Re: Remotely reading HKLM registry key
Posted: 11-20-2006, 11:23 AM
Hi Jerry,

I'm not liking the sound of this (!), I also must be able to enum and
read these keys for when we do profile migration and profile clean-up.

Jerry West wrote:
> I have been successful in reading the registry on remote Vista systems --for
> the most part. I have no trouble reading the HKCU keys. I can read most of
> the HKLM keys. However, I have found that some of the HKLM keys are not
> accessible for reading. For example, I can read any value within the
> following remote registry key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>
> But if I try to read any value within this remote registry key it fails with
> a permission error (5):
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> Another example...
>
> I can enumerate all of the remote registry keys below the following key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>
> But I cannot enumerate all of the remote registry keys below this key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> I have checked the permissions of the keys in question and I see no
> difference between the keys I can read and the keys I cannot read.
> Obviously, I am admin on both machines or I wouldn't even have been able to
> read the remote keys that I am able to read. I have insured that when I
> access the keys that I pass only KEY_READ as the access parameter. This
> issue only occurs when reading the keys remotely. If I run my program on the
> local Vista system in question I have no issue reading ANY key within HKLM.
>
> Does anyone have a clue as to why only specific HKLM keys are being blocked
> and how to overcome that?
>
> Any input would be helpful.
>
> JW
>
>

--
Gerry Hickman (London UK)
Reply With Quote
Jerry West
Guest
Posts: n/a
 
Re: Remotely reading HKLM registry key
Posted: 11-21-2006, 06:58 AM
I've yet to find a solution to this issue nor has anyone responded to my
various posts on this matter in MSDN groups. If you discover something
please do post that here!

Thanks!

JW

"Gerry Hickman" <gerry666uk@newsgroup.nospam> wrote in message
news:%23$1AzZJDHHA.4224@TK2MSFTNGP06.phx.gbl...
> Hi Jerry,
>
> I'm not liking the sound of this (!), I also must be able to enum and read
> these keys for when we do profile migration and profile clean-up.
>
> Jerry West wrote:
>> I have been successful in reading the registry on remote Vista
>> systems --for the most part. I have no trouble reading the HKCU keys. I
>> can read most of the HKLM keys. However, I have found that some of the
>> HKLM keys are not accessible for reading. For example, I can read any
>> value within the following remote registry key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>>
>> But if I try to read any value within this remote registry key it fails
>> with a permission error (5):
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>>
>> Another example...
>>
>> I can enumerate all of the remote registry keys below the following key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>>
>> But I cannot enumerate all of the remote registry keys below this key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>>
>> I have checked the permissions of the keys in question and I see no
>> difference between the keys I can read and the keys I cannot read.
>> Obviously, I am admin on both machines or I wouldn't even have been able
>> to read the remote keys that I am able to read. I have insured that when
>> I access the keys that I pass only KEY_READ as the access parameter. This
>> issue only occurs when reading the keys remotely. If I run my program on
>> the local Vista system in question I have no issue reading ANY key within
>> HKLM.
>>
>> Does anyone have a clue as to why only specific HKLM keys are being
>> blocked and how to overcome that?
>>
>> Any input would be helpful.
>>
>> JW
>
>
> --
> Gerry Hickman (London UK)

Reply With Quote
Kurt Harriger
Guest
Posts: n/a
 
Re: Remotely reading HKLM registry key
Posted: 11-25-2006, 03:40 PM
There is a setting in the Local Security Policy named Network Access:
Remotely accessible registry paths.
This includes HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion which might
explain why you are able to read that key but not the others.

HTH

- Kurt


"Jerry West" <jw@comcast.net> wrote in message
news:12kv2h46q3sp8e2@news.supernews.com...
>I have been successful in reading the registry on remote Vista
>systems --for the most part. I have no trouble reading the HKCU keys. I can
>read most of the HKLM keys. However, I have found that some of the HKLM
>keys are not accessible for reading. For example, I can read any value
>within the following remote registry key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>
> But if I try to read any value within this remote registry key it fails
> with a permission error (5):
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> Another example...
>
> I can enumerate all of the remote registry keys below the following key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>
> But I cannot enumerate all of the remote registry keys below this key:
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>
> I have checked the permissions of the keys in question and I see no
> difference between the keys I can read and the keys I cannot read.
> Obviously, I am admin on both machines or I wouldn't even have been able
> to read the remote keys that I am able to read. I have insured that when I
> access the keys that I pass only KEY_READ as the access parameter. This
> issue only occurs when reading the keys remotely. If I run my program on
> the local Vista system in question I have no issue reading ANY key within
> HKLM.
>
> Does anyone have a clue as to why only specific HKLM keys are being
> blocked and how to overcome that?
>
> Any input would be helpful.
>
> JW
>
Reply With Quote
Kurt Harriger
Guest
Posts: n/a
 
Re: Remotely reading HKLM registry key
Posted: 11-25-2006, 03:46 PM
Nevermind, this setting only applies to anonymous users which you definately
don't want reading this key, so I don't know.

- Kurt

"Kurt Harriger" <kurtharriger@comcast.net> wrote in message
newsFE8D1ED-24E7-40F1-81AA-D70D42E0ABEA@microsoft.com...
> There is a setting in the Local Security Policy named Network Access:
> Remotely accessible registry paths.
> This includes HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion which
> might explain why you are able to read that key but not the others.
>
> HTH
>
> - Kurt
>
>
> "Jerry West" <jw@comcast.net> wrote in message
> news:12kv2h46q3sp8e2@news.supernews.com...
>>I have been successful in reading the registry on remote Vista
>>systems --for the most part. I have no trouble reading the HKCU keys. I
>>can read most of the HKLM keys. However, I have found that some of the
>>HKLM keys are not accessible for reading. For example, I can read any
>>value within the following remote registry key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>>
>> But if I try to read any value within this remote registry key it fails
>> with a permission error (5):
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>>
>> Another example...
>>
>> I can enumerate all of the remote registry keys below the following key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
>>
>> But I cannot enumerate all of the remote registry keys below this key:
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
>>
>> I have checked the permissions of the keys in question and I see no
>> difference between the keys I can read and the keys I cannot read.
>> Obviously, I am admin on both machines or I wouldn't even have been able
>> to read the remote keys that I am able to read. I have insured that when
>> I access the keys that I pass only KEY_READ as the access parameter. This
>> issue only occurs when reading the keys remotely. If I run my program on
>> the local Vista system in question I have no issue reading ANY key within
>> HKLM.
>>
>> Does anyone have a clue as to why only specific HKLM keys are being
>> blocked and how to overcome that?
>>
>> Any input would be helpful.
>>
>> JW
>>
>
Reply With Quote
 
LinkBack Thread Tools Display Modes
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
UAC and permissions on HKLM registry Doug Walch Windows Vista Security 3 10-28-2006 02:59 PM
how can I delete registry key value in HKLM Rastlin Chen Windows Vista Security 2 09-08-2006 02:42 PM
What is HKLM? Gordon Nelson Windows XP Configuration & Management 3 09-23-2004 12:43 AM
remotely francis Windows XP Work Remotely 0 11-15-2003 05:07 AM
HKLM\ENUM PaulH Windows XP Setup 1 06-30-2003 01:34 PM