Windows 2008 R2 Permission Denied Updating Registry

Forums › IT Pro and developers › Windows 2008 R2 Permission Denied Updating Registry

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Topic # 65297 2-Aug-2010 10:06

I am having trouble deleting Registry Keys in Windows 2008 R2. (Windows 2003 is lets you delete the same keys). Am logged on as Administrator and have also right clicked the exe to Run as Administrator.

For example, using Regedit, Regedt32, PsTools PsExec and Windows PowerShell all give Permission Denied Messages when Deleting the key:

HKLM\System\CurrentControlSet\Enum\FTDIBUS

Which contains USB to Serial Devices that I want to remove. I get "Cannot delete 'keyname:' Error while deleting key." Permissions can also not be changed. Applies to the whole Enum key tree.

I'd appreciate anyone being able to tell me how to delete these device keys in Windows 2008 R2.

Oh no, not another end of the world prediction

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Reply # 362211 3-Aug-2010 11:32

Is there not a single Geek out there who has Windows 2008 R2 and can comment on why these Registry entries can't be changed/deleted?

This question was moved from the Operating Systems section Microsoft Windows forum to the Platforms section IT Pro forum perhaps this is why no one is responding?

Perhaps no one uses Windows 2008 R2 in NZ.

I await the skilled contributions of any Geeks to solve this problem.

Shoes2468

672 posts

Ultimate Geek
+1 received by user: 53

Reply # 362259 3-Aug-2010 12:04

Hi there
You need to be logged in as the local administrator, and if you still have problems you need to modify the registry permissions for that particular key, select the folder which the key is in then edit > Permissions, then give administrators "full access". Then you should be able to edit anything in that registry folder. After you have finished modifying the registry it would be good practice to reset the permissions to as they were before hand. Obviously I dont need to tell you the risks of modifying the registry as i'm sure you are aware. It seems that in 2008 R2 that even admins have read only access to the registry for security reasons. I'm not an expert but am currently studying server 08 and 08 R2. See how you go

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Reply # 362280 3-Aug-2010 12:25

1) I am logged on as the local Administrator.
2) I have tried to modify the Permissions but get Permission denied.

Both of these points are mentioned in my original post.

I understand the risks of modifying the registry. I know I can change the key I want updated without issues in Win 2003 after modifying the Permissions. The problem is that Win 2008 R2 won't let you change these keys nor change the Permissions even if you are logged on as an Administrator.

Shoes2468: It seems that in 2008 R2 that even admins have read only access to the registry for security reasons.

Yes, that is the problem I have - is it solvable?

buzzy

217 posts

Master Geek
+1 received by user: 2

Reply # 362350 3-Aug-2010 13:47

I've had some similar issues with Windows 7. The solution - and it was a long-winded one -was to drill down and set permissions and ownership for each specific leaf-node registry entry.

Navigate down to the bottom/leaf key. Take ownership of the key via right click -> Permissions -> Advanced -> Owner -> select "Change owner to:" and use either the Administrators group or your currently logged-in account. Then tick "Replace owner on subcontainers and objects" and apply.

Then, click Advanced again, add or edit permissions to ensure the Administrators group has full control over the key. Select "Replace all child object permissions with inheritable permissions from this object" and click okay.

Then delete the key.

Rinse and repeat for each leaf key. Once you've removed all the leaves under a parent key, you can do the same process to the parent key. Work your way back up, until you've deleted everything you need to.

Simply doing this at the top level of the branch I wanted to delete doesn't work. For some reason, even though this should replace the permissions and ownership all the way down to the leaves, it doesn't.

Someone suggested elsewhere to use PSEXEC to run Regedit as NTAUTHORITY/System (or whatever the heck it's call in 2k8) because that has permissions to the ENUM tree. You might try that, it may be quicker.

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Reply # 362381 3-Aug-2010 14:24

Thanks buzzy, I'll give this a try...

I have tried PsExec thinking it would work (see my original post) but it didn't work with Access Denied.

Why have Microsoft done this? I know, you can puckeroo things, but that is my problem not theirs. It would be nice to delete the whole tree in one go though.

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Reply # 362413 3-Aug-2010 15:05

Have looked at the keys - there are 6 to clear which each go 5 levels deep so there are 30 to process.

This is messy to do. Will see if I can get PsExec to work as, as you have said, this would be easier if I can get it to work.

buzzy

217 posts

Master Geek
+1 received by user: 2

Reply # 362500 3-Aug-2010 16:27

Wandering through each key and taking ownership certainly isn't a quick fix, but it was the only one I could find that worked. Let us know how you get on.

geek4me

830 posts

Ultimate Geek
+1 received by user: 77

Trusted

Lifetime subscriber

Reply # 362511 3-Aug-2010 16:39

Good news!

PsExec (from PSTools) does the job provided it is run from a remote machine as follows:

C:\Pstools>psexec \\2008server -s -i regedit

This launches psexec from my remote XP pc and starts regedit with full edit permissions on the 2008 server.

A warning to others - don't let it be fool edit permissions. Know what you're editing if you use this tool so you won't be a fool and delete critical stuff.

Thanks to those who contributed their comments!