Question

My application needs to read an option on startup to check if it should start in read-only mode. The option should not be allowed to be changed by the user.

I usually do this now using a value set in the HKLM\Software section of the system registry. The administrator sets the value and the users can’t change it (they don’t have rights to modify entries in HKLM).

The problem is that on a terminal server (or Citrix) machine this affects all users. I’d like to figure out a way to do this on a per-user basis. How do others handle this? Is there a section in the system registry for this kind of per user setting that the user can’t change?

Thanks for any suggestions or comments!

Answer 1

This is essentially what the HKEY_CURRENT_USER\Software\Policies key is for, i.e. a key within the user-specific part of the registry that is by default read-only to the user himself.

By convention the key hierarchy should complement the one you already have under HKEY_CURRENT_USER\Software, e.g. if your regular user preferences are stored under HKEY_CURRENT_USER\Software\MyCompany\MyProgram then the protected user preferences (or “policies” in MS lingo) should be stored under HKEY_CURRENT_USER\Software\Policies\MyCompany\MyProgram

Note that it is recommended to only set values under this key via Group Policy Objects and never by direct registry access.