虽然有可能只是
grant full control of the HKCR key
,这可能会导致授予比必要更多的访问权限。在研究如何做到这一点时,有一次我在HKCR上使用了权限,导致需要重新映像我的机器。为了编写这个脚本,我使用了
procmon
工具,并过滤拒绝的注册表权限,然后在脚本中授予它们。
$buildAcctUserName
-设置规则时使用的帐户。
$buildAcctUserName = "AzureDevOpsBuilder"
# Create Rule for full control of keys that need to be added to/updated/deleted from
$user = New-Object System.Security.Principal.NTAccount("$($env:COMPUTERNAME)\$buildAcctUserName")
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
$user,
[System.Security.AccessControl.RegistryRights]"FullControl",
[System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit", <# ContainerInherit / None / ObjectInherit #>
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AccessControlType]::Allow)
# Grant access to HKCR
$regHKCRHive=[Microsoft.Win32.RegistryHive]::ClassesRoot;
$regHKCRBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKCRHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKCRBaseKey.OpenSubKey("", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKLM\Software
$regHKLMHive=[Microsoft.Win32.RegistryHive]::LocalMachine
$regHKLMBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKLMHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKLM\Software\Wow6432Node
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE\Wow6432Node", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKCR\Wow6432Node\CLSID
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\CLSID", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKCR\TypeLib
$regkey=$regHKCRBaseKey.OpenSubKey("TypeLib", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKCR\Wow6432Node\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\Interface", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKCR\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Interface", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)
# Grant access to HKCR\AppID
$regkey=$regHKCRBaseKey.OpenSubKey("AppID", $true)
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)