Registry Bypass?

Okay.... Say i was a computer admin at a school and access to the registry had been disabled for security reasons.

Wouldn't The following code, if executed in a batch file re-enable access to regedit?
=================================================

REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]"DisableRegistryTools"=dword:00000000

=================================================
If so how would i go about stoping users from executing such a command and gaining access to the registry?

Spools..................really!!!!


Try renaming regedit.exe to "your public execution will happen at dawn.exe"


:D


Cheers

EDIT: sorry just hide the executable? and disallow floppy/cd drives............there are other ways, but I will have to think..........what OSes are you thinking of here?

Simply do not allow non-administrator accounts execute access on that file.

-Maestr0

Rename regedit to something else?

I tested it on my system and if came back as "The system cannot find the path specified." and yes I spelled it all correctly. (copy - paste)

Oh yeah.. Soulfly RUCKS!!!!

couldn't you still do it through command prompt?

XP and/or 98

No, the code wouldnt work no matter what O/s you run or how many times you try it!

And since it does not work you need not worry about stopping other people trying it.

Maestr0's answer sound fine for NT4/WIN2K/XP as they have comparatively good security. 9x and Me are home user OSes so are more difficult. You can remove the "run" option from the start menu,which makes it more difficult, but it would be relatively easy to reinstate it unless you disable the floppy/CD drives.

Perhaps I should ask the question what do you want to allow the users to do?

I haven't looked at your batch file code but I would have thought that a correctly defined .reg file if double clicked would do what you say in 9x/Me? because these OSes don't acknowledge an "administrator" as such? So if you can't do it............no one can?

Cheers

EDIT : I have just looked at a 98se machine, and the path isn't there..............gets as far as "policies" then just offers "explorer" or "network"

Me gets as far as "policies", but there is nothing in it.

I think you have left out some information? like how would you set up the control in the first place, and still allow authorised access to the Registry. I am talking 98 and Me?

I still believe that you would need physical security with the home systems, and possibly some third party security application. Anyway they are obsolete OSes, so is it worth it?

Quote:

---

NOKIA:
No, the code wouldnt work no matter what O/s you run or how many times you try it!

And since it does not work you need not worry about stopping other people trying it.

---

Considering that you did not try the code every operating system you have no right to say that it will not work on any of them. I ran the script on my computer and it worked. I wouldn't recomend giving out advice like that again unless your absolutely sure its true.

I ran it on 98, me and xp and i didnt work dood, sorry.

Put the following in a ".reg" file

Quote:

---

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=dword:00000000

---

And put the following in a batch file

Quote:

---

REGEDIT /S <name of reg file>.REG

---

Run the batch file and that should work.

Well,

I got a bit further that time. I now have a folder called "system" on the 98se machine but it just says "default" and "no values"...............as the default is to allow registry editing, is that right?

I don't quite understand the significance of this with the 9x systems as there are lots of registry editing tools out there that don't use regedit.exe? You might have a chance at reasonable remote security, but I cannot see it if someone has physical access to a fully configured (CD & floppy) machine.

Cheers

if you add "DisableRegistryTools"=dword:00000001 then that will dissallow acces to regedit. if you add "DisableRegistryTools"=dword:00000000 to it then it will allow it.

The aspect that I would be most curious about is that is the batch being executed before or after a log-onhas been made. The reason I say this is, that if a user that is executing this type of command would not be able to if he/she didn't have regedit access in the first place. The only way that I could actually see this working is that if you ran the batch command even before a log-on was made. Yes, a different registry entry would have to be exploited but it's all relative.

scat

This requires the ability to write to the registry already so no new privileges are granted you are just allowing the user to do something they are already allowed to do in a more straight forward manner.
My system for example allows local domain users to access the registry via regedit, they can read and write only to the entries they have access to. Using access to regedit to attempt to control the regisrty is a non-functional, feeble attempt. it's like trying to restrict access to a text file by disallowing the user to use notepad, pretty lame and just plain not gonna work.

So to answer your question, no that would not allow users to do anything extra and consequently it need not be secured. (If you are talking about the SUE line of Windows, don't bother trying to secure it, it has no security policy and anything you do is bypassable.)

catch

If you want to lock the registry why don't you just use the permissions function. You can lock down anything from a hive to a key. So, for example, you could lock the "run" key to , administrator's only. Thus any "nasty" trying to add itself to the registry would fail when a regular or power user executes the file.

Just whilst there is a thread about batch files, would this only delete the contents of a temp folder?

DEL /S /Q /F "%USERPROFILE%\Local Settings\Temp\*.*"
DEL /S /Q /F C:\WINNT\Temp\*.*"
DELTREE /Y C:\WINDOWS\TEMP\*.*

Thanks.

(obviously different lines for different o/s's)

Nokia: It's going to delete exactly what you have told it to delete except the last line will not delete any subfolders that might have been created in the Windows\temp folder.... Or am I misunderstanding your question?

No, sorry My fault,
I have just been here http://www.experts-exchange.com/Netw..._20721764.html
and seen the persons post and thought it was a good idea.

I am going to do the same thing he is but i just wanted to make sure that nothing else would be deleted. I didnt understand the /S /Q /F part!

Thanks.

Go to the command prompt and type:

del /?

it gives you an explanation of the switches and what they do for you......

All command prompt commands have the /? switch that, sometimes :confused: explain what the hell it "might" do..... :rolleyes:

So it does!!
Thank you very much!!!

Word of warning: Don't expect the "syntax" they quote to always be of use.... You will often find that you have to type the same command with subtle nuances 20 frigging times before you don't error out.... then you find the _exact_ thing they are looking for and it works fine.... 3 days later I have $5 says you can't remember that last stupid little nuance...... ;)