2

This may be an already answered question but I couldn't find any references to it here on superuser.

I have a situation whereby a process that's installed on my Windows 10 box changes a particular registry key whenever it runs. I would like to protect this registry key from being modified by any other process.

Does anyone know of any programs that does the following... Run in the background, keeping a watch on any changes to one (or more) given registry key(s), and if any other process attempts to change it, it either prevents them from changing it, or it allows the change and simply changes it right back to a value I provide?

And before you ask... No, I can't remove or prevent this process from running. It does several other things, but I don't care about any of those. I simply care about the change it makes to this one registry key.

Any pointers in the right direction would be much appreciated.

rdragon78
  • 31
  • What are the permissions currently set on the specific registry key (in regedit you can right click the registry key and choose "Permissions...)", and what specific program is changing this (it changes the answer based on what program it is)? Edit your post with the output of this, rather than trying to rewrite the permissions you see, with powershell Get-Acl -Path HKLM:\Path\to\the\specified\key | Format-List – El8dN8 Nov 26 '17 at 03:04
  • I am going to guess you don’t have the permissions on the domain required to make the modifications required by any solution we can provide. – Ramhound Nov 26 '17 at 03:52
  • I'm voting to close this question as off-topic because it's about circumventing network security/policies at an institution. – DavidPostill Nov 26 '17 at 13:33
  • So if someone from Iraq in 2000 would ask about secure messaging, you would close the question as he is obviously about to circumvent network security/policies? – David Balažic Jun 20 '20 at 20:49

1 Answers1

3

Change permission of the key (and descendants) to NT Service\TrustedInstaller. This will stop most non-Microsoft applications from altering the setting. You will need to change this back to the previous settings if changes are needed, so export the Registry key before you change permissions.

Change Permission

To go back to the previous setting, first replace TrustedInstaller with yourself or Administrator.

N.B. If this is required by company policy, think twice before making a change, and check with an administrator! It might be worth your job.

DrMoishe Pippik
  • 29,631
  • 5
  • 41
  • 58