Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Controlling Access to Registry Keys

Registry keys are permissioned by default and should not be modified without a thorough understanding of the impact of the modification. Registry keys are also added by applications and via configuration settings. Changing permissions on these keys may prevent applications from running.

Default Registry Permissions

Figure 5-27 displays registry permissions, and they are listed and described in Table 5-8. Alhough registry permission names are different from file permissions, they are similar in use. Two main permissions, Full Control and Read, are composed of special permissions. Special permissions can be explicitly assigned.

Registry key permissions inheritance is similar to that described in the file system and can be blocked to protect permissions on sensitive subkeys, as shown in Figure 5-28.

Applying Registry Permissions

Registry permissions, like object permissions for files and folders, may be applied directly using the object picker within the Registry Editor, by application through security templates, and by using Group Policy,

The regedt32.exe program is not part of Windows XP or Windows Server 2003. However, the features that differentiate it from regedit.exe, such as the ability to set security permissions, set audit permissions, and assign ownership of a key, have been added to regedit. An additional feature of regedit in Windows Server 2003 is the Favorites feature. As you work with registry keys, you can put your frequently used keys on the Favorites menu in regedit. Clicking the menu entry opens the stored subkey record.

To modify registry key permissions, follow these steps:

Changing ownership of a registry key is a two-part process: First, an administrator or other user with ownership permission must assign ownership to a new user, and then the designated user must take ownership. The exception to this rule is that users with the Take Ownership permission may change ownership to their own account. To change ownership of a registry key, do the following:

The new owner completes the owner change process by using Take Ownership of the key to complete the process. This two-part process serves a distinct security role. It separates the process of giving ownership permission from the process of taking ownership. This is important because it prevents a malicious person with the Take Ownership right from taking ownership, giving themselves permissions, changing, viewing, or deleting data, and then giving ownership back to the original owner in an attempt to avoid detection or to avoid being held accountable for his act. Because the duties are separated, the attacker retains ownership of the object and cannot deny that he had the opportunity to use this capability to obtain information or to do some task that he is not authorized to do.