3

So here's a spicy one for you guys...

I changed permissions on a registry folder (HKEY_CURRENT_USER\Control Panel\Keyboard) to "Deny Everyone". I had a good reason for doing it (long story) but it didn't resolve my issue (somehow the system is still changing it... mind boggling).

How can I fix this/can I fix this? I've tried everything I can think, including safe mode administrator account, but I can neither change the permissions nor reclaim ownership. I also tried the takeown command on the NTUSER.DAT file which is what I think contains that node, but while the command claimed success I'm still unable to access this registry folder or the keys inside.

Any ideas that don't involve reinstalling Windows? I'm on Windows 10.

Improve this question
16
  • 1
    "I changed permissions on a registry folder (HKEY_CURRENT_USER\Control Panel\Keyboard) to Deny Everyone." I'm sure that you genuinely believed you had a good reason for doing that, but I have never heard one.
    – Run5k
    Commented Jul 21, 2018 at 15:13
  • Try running regedit as system or TrustedInstaller. Only thing I can think of that might help. Other than using another tool to change permissions or mounting the NTUser.dat hive as another user. - blogs.technet.microsoft.com/askds/2008/10/22/…
    – mt025
    Commented Jul 21, 2018 at 15:19
  • 1
    @Run5k Every time I miracast for my third monitor this registry gets changed inexplicably and screws up my keyboard input settings. This happens multiple times a day. It's rage-inducing. I had no idea what else to try.
    – George Barron
    Commented Jul 21, 2018 at 17:25
  • 1
    The owner of a securable object always has write-DAC permissions (except in one really arcane case). What happens if you try to use the Registry Editor's Permissions window to change the permissions or take ownership? Are things just grayed out?
    – Ben N
    Commented Jul 21, 2018 at 17:29
  • 2
    You're correct @Rathlord. I just tested it. There is a very conspicuous warning when you set DENY everyone permissions stating that ONLY the OWNER of the key will be able to change permissions. Therefore, WHO is the owner? The owner on my system is SYSTEM. So, simply download psexec and run psexec -i -s regedit.exe and you'll be able to change permissions.
    – Appleoddity
    Commented Jul 21, 2018 at 17:40

2 Answers 2

Reset to default
5

When you set EVERYONE DENY permissions you receive a warning that only the OWNER of the key will be able to change permissions or access it. On my Windows 10 system, the owner is SYSTEM. In most cases, it would be either SYSTEM, TRUSTED INSTALLER, or ADMINISTRATORS.

Therefore, we can fix this issue by running regedit as SYSTEM. In order to do so, we need to download pstools and extract the tools to a folder on your computer. On my system, I extracted them to D:\Downloads.

Now, we want to run Regedit as SYSTEM. To do this, open an administrative command prompt and change directories to where you expanded the PSTOOLS file (CD D:\Downloads). In that folder, is psexec. We will run the command psexec -i -s regedit.exe and Regedit will open.

Regedit is now running as the SYSTEM user. Therefore, HKEY_CURRENT_USER is not YOUR registry, it is the SYSTEM registry. Now we have to navigate to your registry key. We will find that under HKEY_USERS. This key holds the registry of all currently mounted (logged in) user registries.

Within HKEY_USERS you will find a series of keys that start with S-1-5-xxx and so on. The longer keys that end in -1001, -1002, etc. are your logged on users. Expand each one to find the one that corresponds with your user registry. You can open the Environment key under each one and you will most likely see an item with the name of what user the key is associated with. By this method you can find the right S-1-5-xxx key. At the very least, you can open each one, and check the permissions of Control Panel\Keyboard. You will definitely find which one has the bad permissions on it.

Now that you know how to find the Control Panel\Keyboard key that corresponds with your user account you can simply right-click it and change permissions. Remove the EVERYONE DENIED permission.

On a side note, the system is able to continue to make changes to the key because SYSTEM owns the key. If you are trying to prevent the system from making changes to this key, then what you want to do is change the ownership of the key to your own user name. Then deny SYSTEM from making changes to the key. However, you cannot deny "Full control" to SYSTEM or the system won't even be able to read the key and no telling what will happen. Instead, you will need to go to "Advanced permissions" and deny the "Set Value" permission.

Improve this answer
5
  • Thanks for the solve Apple and I'll give that additional solution a try to maybe sort out the original issue. Many thanks for your help!
    – George Barron
    Commented Jul 21, 2018 at 18:12
  • Doesn't the registry have a way to take ownership of keys, much like how administrators can takeown a file?
    – grawity_u1686
    Commented Jul 21, 2018 at 18:33
  • @grawity I have yet to test this with NTFS, but I did test it on the registry. Once you set everyone denied, you receive a warning only the owner will be able to access the key or change permissions. I can confirm, you cannot take ownership at this point. It’s something I suspect will also happen with NTFS. I’ve never set everyone denied, so it was news to me.
    – Appleoddity
    Commented Jul 22, 2018 at 4:36
  • 1
    No – administrators have SeTakeOwnershipPrivilege, which lets them become the owner regardless of the object's permissions. (That's how takeown works.) In theory that should be doable for any object, not just files.
    – grawity_u1686
    Commented Jul 22, 2018 at 6:36
  • Works for me! Thanks! (with voting up of course)
    – ch271828n
    Commented Sep 11, 2019 at 1:46
2

I think you need some 3rd party tools (and OS) to edit registry when windows is offline. Try registry edit utility that can edit windows registry while it shutdowned.

Here is one that you can use:

https://pogostick.net/~pnh/ntpasswd/

You can also try to edit broken registry on another computer running Windows by "Load Hive" from File menu and feed it with registries from computer that need to be fixed. (But personally I prefer to do such things from non windows OS)

Standard precaution: In any cases be carefully when messing with registries.

Improve this answer
1
  • I do have a Linux install alongside, maybe I'll give this a shot.
    – George Barron
    Commented Jul 21, 2018 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .