Rem: Changing Registry Permissions

Sometimes I need to change permissions in a machine's registry for an application to run. For example, for Microsoft Photo Editor in the Microsoft Office 2000 suite, I need to change permissions in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools registry subkey. Otherwise, Photo Editor won't run. Up to this point, I've either used regedt32 to manually change the permissions on the user's machine or given the user Administrator privileges on the local machine. I'd much rather use a script to set these registry permissions. I know I can use WSH to read and write to the registry, but can I use WSH to set permissions in it?

You can't use the registry methods that the WshShell object exposes to set registry permissions. However, you can use subinacl.exe or adssecurity.dll. Of these solutions, only adssecurity.dll supports remote registries.

Subinacl.exe is a command-line utility in the Microsoft Windows 2000 Server Resource Kit. This utility lets you manage the security descriptor on a variety of securable objects, including the registry. You can find subinacl.exe syntax, usage instructions, and examples in the resource kit's Tools Help document. . . .