regedit no good?

[Linea Recta]

I have been cleaning up some entries in the Windows register using regedit.
However, I still have some obsolete entries left which can't be removed, or
so it seems.
When I try to remove them, I get a message:
"cannot remove ***: an error occured during removing the key", where ***
stands for key in question.

Is this a bug in regedit or is there an other explanation?



Windows 2000SP4
--
regards,

|\ /|
| \/ |@rk
\../
\/os

mccm dot vos at hccnet dot nl

 

[Lanwench [MVP - Exchange]]

In

I have been cleaning up some entries in the Windows register using
regedit. However, I still have some obsolete entries left which can't
be removed, or so it seems.
When I try to remove them, I get a message:
"cannot remove ***: an error occured during removing the key", where
*** stands for key in question.

Is this a bug in regedit or is there an other explanation?

Check the permissions on those keys - and set Everyone = Full Control. Then
try again.

 

[Jim Howes]

Check the permissions on those keys - and set Everyone = Full Control. Then
try again.

Alternatively, run REGEDT32 as SYSTEM.

Regedit itself has been shown to have problems with long key/value names,
rendering them invisible (and a favourite hangout for malware). REGEDT32 seems
to be able to see these.

As for running as SYSTEM (the all-powerful user, more powerful than a mere
Administrator), you can do so with 'at'; from the command line, check the time,
and type:

(assuming local time is 12:33)
C:\> AT 12:34 /INTERACTIVE REGEDT32

Wait a minute, and REGEDT32 will open, but running as NT AUTHORITY\SYSTEM, where
mere trifles like permissions on keys will not get in your way.

Be aware, of course, that you are playing with fire here, and you are likely to
get your fingers burnt. Sit on your hands before doing hitting return/clicking,
and keep your backup handy.

Another reason you may not be able to remove a key is that a process has that
key in use.

 

[Stubby]

Alternatively, run REGEDT32 as SYSTEM.

Regedit itself has been shown to have problems with long key/value names,
rendering them invisible (and a favourite hangout for malware). REGEDT32 seems
to be able to see these.

As for running as SYSTEM (the all-powerful user, more powerful than a mere
Administrator), you can do so with 'at'; from the command line, check the time,
and type:

(assuming local time is 12:33)
C:\> AT 12:34 /INTERACTIVE REGEDT32

Wait a minute, and REGEDT32 will open, but running as NT AUTHORITY\SYSTEM, where
mere trifles like permissions on keys will not get in your way.

Be aware, of course, that you are playing with fire here, and you are likely to
get your fingers burnt. Sit on your hands before doing hitting return/clicking,
and keep your backup handy.

Another reason you may not be able to remove a key is that a process has that
key in use.

Great tip! Do all acheduled jobs run as SYSTEM? Can anyone fire off
such a job? I hope there are controls on this.

 

[Jim Howes]

Great tip! Do all acheduled jobs run as SYSTEM? Can anyone fire off
such a job? I hope there are controls on this.

I have to credit ISC for the tip..

Only administrators can schedule jobs with 'AT'.
Regular users will get 'Access is denied'

Of course, on the average system, everyone is an administrator. In WinXP home
installs, virtually everyone has to be, because to be otherwise is to live in a
strait jacket. XP Professional has somewhat less restrictive levels and
controls similar to 2K.

Having unrestricted access via NT AUTHORITY\SYSTEM is, in my view, an extremely
bad idea. I'm not even comfortable giving trusted users the password to the
'root' account on our unix servers, preferring to provide access to things that
must be done as root to either properly written software that runs setuid, or
access via sudo. This brings up a question: Is it possible to run a given task
as an administrator (or user X), even if the user running it is not an
administrator. The 'Run As' service does not help in this regard as it requires
a password; i.e. in the same way as the unix 'passwd' command does (changes the
user's password, needs write access to files owned by root, hence runs as root,
but runnable without the root password by ordinary mortals)

I'd have expected this to be a local policy setting, somewhere under User Rights
Assignment in secpol.msc, but it is either not there, or I've gone blind. There
is nothing in the online help that suggests that it is administrators only, but
I beleive the ability to schedule tasks revolves around the ability to write to
C:\WINNT\Tasks - Explorer will not show you the permissions on this directory,
you'll have to jump to the shell and examine it with CACLS instead (because
explorer is being 'helpful' (i.e. useless) because it knows the directory has
special properties)

Jim

 

[Linea Recta]

"Lanwench [MVP - Exchange]"

In

Check the permissions on those keys - and set Everyone = Full Control. Then
try again.

You mean it isn't sufficient to be logged in as administrator?



--

|\ /|
| \/ |@rk
\../
\/os

mccm dot vos at hccnet dot nl

 

[Linea Recta]

Alternatively, run REGEDT32 as SYSTEM.

Regedit itself has been shown to have problems with long key/value names,
rendering them invisible (and a favourite hangout for malware). REGEDT32 seems
to be able to see these.

Thanks, I wasn't aware of this program. I find it rather disorientating
though, specially because it seems I can't make the full path visible like I
had in regedit.

As for running as SYSTEM (the all-powerful user, more powerful than a mere
Administrator), you can do so with 'at'; from the command line, check the time,
and type:

(assuming local time is 12:33)
C:\> AT 12:34 /INTERACTIVE REGEDT32

Wait a minute, and REGEDT32 will open, but running as NT AUTHORITY\SYSTEM, where
mere trifles like permissions on keys will not get in your way.

I fail to see what the local time has to do with it. I am logged in as
administrator.

Be aware, of course, that you are playing with fire here, and you are likely to
get your fingers burnt. Sit on your hands before doing hitting return/clicking,
and keep your backup handy.

Another reason you may not be able to remove a key is that a process has that
key in use.

I think it may have been removed despite of the error because I can't find
it anymore...



--
regards,

|\ /|
| \/ |@rk
\../
\/os

mccm dot vos at hccnet dot nl

 

[Gunrunnerjohn]

I believe that REGEDIT in 2K doesn't have the capability to change permissions
on keys, however REGEDT32 does have that capability. This is different than how
things work on XP.

 

[Lanwench [MVP - Exchange]]

In

I believe that REGEDIT in 2K doesn't have the capability to change
permissions on keys, however REGEDT32 does have that capability.
This is different than how things work on XP.

You're right - sorry, I forgot where I was. I sub to too many groups. In
Win2003/XP you can do pretty much everything using regedit. Not so in
NT/2000.