Question

I work in c++builder with registry. Anybody know how to set program privileges for deleting keys in HKEY_LOCAL_MACHINE?

I try to use reg->deletekey();

And:

RegDelnode(HKEY_LOCAL_MACHINE, TEXT("Software\\Test"));

But not one of them worked.

Answer 1

In very broad terms you need to have administrator privileges to write/delete HKLM.

More specifically, you need some combination of the standard DELETE right and the registry-specific KEY_WRITE, KEY_SET_VALUE, KEY_CREATE_SUB_KEY rights. And maybe others, depending on exactly what you want to do. A common strategy is to have an administrator assign the appropriate rights for a specific registry key to a specific user, and from that time on the the nominated user can write/delete the key and its values without further recourse to the administrator.

You can write your own administrator tool to assign these rights, or you can use Microsoft or third-party tools. Microsoft provide a tool called subinacl.exe at http://www.microsoft.com/downloads/en/details.aspx?familyid=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en.

To assign rights in an admin tool of your own devising, check out the Windows API functions SetSecurityInfo and SetEntriesInAcl. To find the specific rights you need, browse the documentation for RegDeleteKey.

It’s somewhat tricky to get this right, but that’s because it’s a sensitive and important topic and so I think you just have to roll up your sleeves and get stuck in. For example, the order of ACEs in an ACL is important, and there’s a difference between REVOKE_ACCESS and DENY_ACCESS.