Regperm

The Regperm application was designed to be a console based utility for setting and modifying registry permissions. It is able to work remotely. Regperm will work from any directory and requires no special installation considerations.

Windows uses the concept of Discretionary Access Control Lists (DACLs) along with Access Tokens to control who has access to various resources. When a user logs in to Windows, the Security Accounts Manager (SAM) is queried and returns an access token representing the user and any groups they may belong to. This token is then attached to the users shell (typically explorer.exe) and is used to access resources such as files, registry keys and other processes.

A DACL is a list of Access Control Entries (ACEs) that describe who may (or may not) use a particular resource along with what their rights are. Each key in the registry has its own DACL with ACEs for users/groups. When a call to access the registry is made, each ACE is checked to see if it matches the user or group. If it does then the appropriate permissions are checked to see whether to allow the action in question. Upon the first successful match whether it be an Allow or Deny, the appropriate action is taken. If no matches are found, the the request is denied.

Regperm is used to change the permissions on registry keys by modifying their DACLs. You may edit an existing DACL or replace it entirely. You may allow users certain rights or deny them the same. You may also propogate the modifications to the subkeys of a particular registry key.