If you have the right to change permissions on an object, but receive Access Denied, you may be the victim of hieghtened security. Edit:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths

Double click Machine or add value as type REG_MULTI_SZ. Add a string of System\CurrentControlSet\Control\ProductOptions so that the ACL editor can determine the product type of the server.