HKEY_LOCAL_MACH INE Registry Access

[Kevin Swanson]

I'm attempting some remote registry manipulation via C#. I've written a test
app to simply grab a specified key from a specified hive on a specified
machine. The call to OpenSubKey is throwing System.Security Exception.

Also of note: Sitting at my local box, I can open regedit and connect to the
remote registry. I see three hives: _CLASSES_ROOT, _LOCAL_MACHINE, and
_USERS. I can open all but HKEY_LOCAL_MACH INE. When I try to expand that one,
I get a simple error message that tells me almost nothing.

So I'm fairly certain I'm running up against some kind of permissions issue.
This is a dev server, but I still don't want to go mucking around too much
without knowing what I'm doing. Via Terminal Services, I added LOCAL SERVICE
to HKEY_LOCAL_MACH INE and a few sub keys. That didn't help. I also found two
interesting entries in the Local Security Polcy: Remotely accessible registry
paths and Remotely accesible registry paths and sub-paths. I didn't mess
around with those much, but I did notice that there's no hive on any of the
entries, and it doesn't LOOK like all of the paths I can see connecting
remotely via regedit are in those lists (but I could be wrong).

So what's the magic formula for accessing these keys remotely? And are some
of them tied down by default? I don't think anyone here specifically decided
to make the local_machine hive inaccessible remotely...

Here's some details:
My Machine: Windows 2000 Professional
Remote Machine: Windows 2003 Server
I'm an admin on both machines...

Just for fun, here's a code sample:

public static RegistryKey GetKey(Registry Hive hive, string key, string server)
{
RegistryKey parentKey;
RegistryKey returnKey = null;

if (server == null || server.Length == 0)
{
server = string.Empty;
}

parentKey = RegistryKey.Ope nRemoteBaseKey( hive, server);
if (parentKey != null)
{
try
{
// THE LINE BELOW THROWS
//
System.Security Exception

returnKey = parentKey.OpenS ubKey(key, true);
}
catch(Exception exception)
{
// handle the exception!
returnKey = null;
}

}

return returnKey;
}

[Willy Denoyette [MVP]]

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:2F******** *************** ***********@mic rosoft.com...

I'm attempting some remote registry manipulation via C#. I've written a
test
app to simply grab a specified key from a specified hive on a specified
machine. The call to OpenSubKey is throwing System.Security Exception.

Also of note: Sitting at my local box, I can open regedit and connect to
the
remote registry. I see three hives: _CLASSES_ROOT, _LOCAL_MACHINE, and
_USERS. I can open all but HKEY_LOCAL_MACH INE. When I try to expand that
one,
I get a simple error message that tells me almost nothing.

So I'm fairly certain I'm running up against some kind of permissions
issue.
This is a dev server, but I still don't want to go mucking around too much
without knowing what I'm doing. Via Terminal Services, I added LOCAL
SERVICE
to HKEY_LOCAL_MACH INE and a few sub keys. That didn't help. I also found
two
interesting entries in the Local Security Polcy: Remotely accessible
registry
paths and Remotely accesible registry paths and sub-paths. I didn't mess
around with those much, but I did notice that there's no hive on any of
the
entries, and it doesn't LOOK like all of the paths I can see connecting
remotely via regedit are in those lists (but I could be wrong).

So what's the magic formula for accessing these keys remotely? And are
some
of them tied down by default? I don't think anyone here specifically
decided
to make the local_machine hive inaccessible remotely...

Here's some details:
My Machine: Windows 2000 Professional
Remote Machine: Windows 2003 Server
I'm an admin on both machines...

Just for fun, here's a code sample:

public static RegistryKey GetKey(Registry Hive hive, string key, string
server)
{
RegistryKey parentKey;
RegistryKey returnKey = null;

if (server == null || server.Length == 0)
{
server = string.Empty;
}

parentKey = RegistryKey.Ope nRemoteBaseKey( hive, server);
if (parentKey != null)
{
try
{
// THE LINE BELOW THROWS
//
System.Security Exception

returnKey = parentKey.OpenS ubKey(key, true);
}
catch(Exception exception)
{
// handle the exception!
returnKey = null;
}

}

return returnKey;
}

You need to be an admininistrator on the remote machine for this to work.

Willy.

[Kevin Swanson]

yeah... I'm an admin on both machines.

"Willy Denoyette [MVP]" wrote:

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:2F******** *************** ***********@mic rosoft.com...

I'm attempting some remote registry manipulation via C#. I've written a
test
app to simply grab a specified key from a specified hive on a specified
machine. The call to OpenSubKey is throwing System.Security Exception.

Also of note: Sitting at my local box, I can open regedit and connect to
the
remote registry. I see three hives: _CLASSES_ROOT, _LOCAL_MACHINE, and
_USERS. I can open all but HKEY_LOCAL_MACH INE. When I try to expand that
one,
I get a simple error message that tells me almost nothing.

So I'm fairly certain I'm running up against some kind of permissions
issue.
This is a dev server, but I still don't want to go mucking around too much
without knowing what I'm doing. Via Terminal Services, I added LOCAL
SERVICE
to HKEY_LOCAL_MACH INE and a few sub keys. That didn't help. I also found
two
interesting entries in the Local Security Polcy: Remotely accessible
registry
paths and Remotely accesible registry paths and sub-paths. I didn't mess
around with those much, but I did notice that there's no hive on any of
the
entries, and it doesn't LOOK like all of the paths I can see connecting
remotely via regedit are in those lists (but I could be wrong).

So what's the magic formula for accessing these keys remotely? And are
some
of them tied down by default? I don't think anyone here specifically
decided
to make the local_machine hive inaccessible remotely...

Here's some details:
My Machine: Windows 2000 Professional
Remote Machine: Windows 2003 Server
I'm an admin on both machines...

Just for fun, here's a code sample:

public static RegistryKey GetKey(Registry Hive hive, string key, string
server)
{
RegistryKey parentKey;
RegistryKey returnKey = null;

if (server == null || server.Length == 0)
{
server = string.Empty;
}

parentKey = RegistryKey.Ope nRemoteBaseKey( hive, server);
if (parentKey != null)
{
try
{
// THE LINE BELOW THROWS
//
System.Security Exception

returnKey = parentKey.OpenS ubKey(key, true);
}
catch(Exception exception)
{
// handle the exception!
returnKey = null;
}

}

return returnKey;
}

You need to be an admininistrator on the remote machine for this to work.

Willy.

[Willy Denoyette [MVP]]

A local admin cannot be admin on two different machines unless it's a shadow
account, that is the credentials (account/password) are the same. Is this
the case?
Willy.

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:DF******** *************** ***********@mic rosoft.com...

yeah... I'm an admin on both machines.

"Willy Denoyette [MVP]" wrote:

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:2F******** *************** ***********@mic rosoft.com...

> I'm attempting some remote registry manipulation via C#. I've written a
> test
> app to simply grab a specified key from a specified hive on a specified
> machine. The call to OpenSubKey is throwing System.Security Exception.
>
> Also of note: Sitting at my local box, I can open regedit and connect
> to
> the
> remote registry. I see three hives: _CLASSES_ROOT, _LOCAL_MACHINE, and
> _USERS. I can open all but HKEY_LOCAL_MACH INE. When I try to expand
> that
> one,
> I get a simple error message that tells me almost nothing.
>
> So I'm fairly certain I'm running up against some kind of permissions
> issue.
> This is a dev server, but I still don't want to go mucking around too
> much
> without knowing what I'm doing. Via Terminal Services, I added LOCAL
> SERVICE
> to HKEY_LOCAL_MACH INE and a few sub keys. That didn't help. I also
> found
> two
> interesting entries in the Local Security Polcy: Remotely accessible
> registry
> paths and Remotely accesible registry paths and sub-paths. I didn't
> mess
> around with those much, but I did notice that there's no hive on any of
> the
> entries, and it doesn't LOOK like all of the paths I can see connecting
> remotely via regedit are in those lists (but I could be wrong).
>
> So what's the magic formula for accessing these keys remotely? And are
> some
> of them tied down by default? I don't think anyone here specifically
> decided
> to make the local_machine hive inaccessible remotely...
>
> Here's some details:
> My Machine: Windows 2000 Professional
> Remote Machine: Windows 2003 Server
> I'm an admin on both machines...
>
> Just for fun, here's a code sample:
>
> public static RegistryKey GetKey(Registry Hive hive, string key, string
> server)
> {
> RegistryKey parentKey;
> RegistryKey returnKey = null;
>
> if (server == null || server.Length == 0)
> {
> server = string.Empty;
> }
>
> parentKey = RegistryKey.Ope nRemoteBaseKey( hive, server);
>
>
> if (parentKey != null)
> {
> try
> {
> // THE LINE BELOW THROWS
> //
> System.Security Exception
>
> returnKey = parentKey.OpenS ubKey(key, true);
> }
> catch(Exception exception)
> {
> // handle the exception!
> returnKey = null;
> }
>
> }
>
> return returnKey;
> }
>

You need to be an admininistrator on the remote machine for this to work.

Willy.

[Kevin Swanson]

Okay, one of is is obviously not understanding something. Probably it's me.

Using Regedit: I'm sitting at my local machine, logged on under my network
account. I pull up regedit, click Registyr/Connect Network Registry, and type
in the remote server name. At this point, I can see the HKLM hive, but I get
an error when I try to open it.

Programmaticall y: Running an app on my local machine, I succeed when calling
RegistryKey.Ope nRemoteBaseKey, but fail when calling OpenSubKey.

So... I don't understand where the local accounts come into play (unless
you're talking about the LOCAL SERVICE account).

"Willy Denoyette [MVP]" wrote:

A local admin cannot be admin on two different machines unless it's a shadow
account, that is the credentials (account/password) are the same. Is this
the case?
Willy.

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:DF******** *************** ***********@mic rosoft.com...

yeah... I'm an admin on both machines.

"Willy Denoyette [MVP]" wrote:

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:2F******** *************** ***********@mic rosoft.com...
> I'm attempting some remote registry manipulation via C#. I've written a
> test
> app to simply grab a specified key from a specified hive on a specified
> machine. The call to OpenSubKey is throwing System.Security Exception.
>
> Also of note: Sitting at my local box, I can open regedit and connect
> to
> the
> remote registry. I see three hives: _CLASSES_ROOT, _LOCAL_MACHINE, and
> _USERS. I can open all but HKEY_LOCAL_MACH INE. When I try to expand
> that
> one,
> I get a simple error message that tells me almost nothing.
>
> So I'm fairly certain I'm running up against some kind of permissions
> issue.
> This is a dev server, but I still don't want to go mucking around too
> much
> without knowing what I'm doing. Via Terminal Services, I added LOCAL
> SERVICE
> to HKEY_LOCAL_MACH INE and a few sub keys. That didn't help. I also
> found
> two
> interesting entries in the Local Security Polcy: Remotely accessible
> registry
> paths and Remotely accesible registry paths and sub-paths. I didn't
> mess
> around with those much, but I did notice that there's no hive on any of
> the
> entries, and it doesn't LOOK like all of the paths I can see connecting
> remotely via regedit are in those lists (but I could be wrong).
>
> So what's the magic formula for accessing these keys remotely? And are
> some
> of them tied down by default? I don't think anyone here specifically
> decided
> to make the local_machine hive inaccessible remotely...
>
> Here's some details:
> My Machine: Windows 2000 Professional
> Remote Machine: Windows 2003 Server
> I'm an admin on both machines...
>
> Just for fun, here's a code sample:
>
> public static RegistryKey GetKey(Registry Hive hive, string key, string
> server)
> {
> RegistryKey parentKey;
> RegistryKey returnKey = null;
>
> if (server == null || server.Length == 0)
> {
> server = string.Empty;
> }
>
> parentKey = RegistryKey.Ope nRemoteBaseKey( hive, server);
>
>
> if (parentKey != null)
> {
> try
> {
> // THE LINE BELOW THROWS
> //
> System.Security Exception
>
> returnKey = parentKey.OpenS ubKey(key, true);
> }
> catch(Exception exception)
> {
> // handle the exception!
> returnKey = null;
> }
>
> }
>
> return returnKey;
> }
>

You need to be an admininistrator on the remote machine for this to work.

Willy.

[Willy Denoyette [MVP]]

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:67******** *************** ***********@mic rosoft.com...

Okay, one of is is obviously not understanding something. Probably it's
me.

Using Regedit: I'm sitting at my local machine, logged on under my
network
account. I pull up regedit, click Registyr/Connect Network Registry, and
type
in the remote server name. At this point, I can see the HKLM hive, but I
get
an error when I try to open it.

Programmaticall y: Running an app on my local machine, I succeed when
calling
RegistryKey.Ope nRemoteBaseKey, but fail when calling OpenSubKey.

So... I don't understand where the local accounts come into play (unless
you're talking about the LOCAL SERVICE account).

<logged on under my network account...>, does it mean you are logged on
using a DOMAIN account (I guess not), or a local account?
You said you were an administrator on both machines, right? This can only be
true if:
- you are logged on using a DOMAIN administrators account that is a member
of the remote and the local machines administrators group, or
- you are logged on as a local administrator who has a shadow account on the
remote machine.
A shadows account is an account with the same credentials
(username/password) having the same privileges (so a member of
administrators in your case).

Hope it clears things up now,

Willy.

[Kevin Swanson]

Willy,

Sorry it's taken so long for a reply. Somehow I didn't receive notice that
you had replied.

I'm signed into a domain account. The domain account is an admin on both
machines.

"Willy Denoyette [MVP]" wrote:

"Kevin Swanson" <ke**********@n ospam.nospam> wrote in message
news:67******** *************** ***********@mic rosoft.com...

Okay, one of is is obviously not understanding something. Probably it's
me.

Using Regedit: I'm sitting at my local machine, logged on under my
network
account. I pull up regedit, click Registyr/Connect Network Registry, and
type
in the remote server name. At this point, I can see the HKLM hive, but I
get
an error when I try to open it.

Programmaticall y: Running an app on my local machine, I succeed when
calling
RegistryKey.Ope nRemoteBaseKey, but fail when calling OpenSubKey.

So... I don't understand where the local accounts come into play (unless
you're talking about the LOCAL SERVICE account).

<logged on under my network account...>, does it mean you are logged on
using a DOMAIN account (I guess not), or a local account?
You said you were an administrator on both machines, right? This can only be
true if:
- you are logged on using a DOMAIN administrators account that is a member
of the remote and the local machines administrators group, or
- you are logged on as a local administrator who has a shadow account on the
remote machine.
A shadows account is an account with the same credentials
(username/password) having the same privileges (so a member of
administrators in your case).

Hope it clears things up now,

Willy.

[Kevin Yu [MSFT]]

Hi Kevin,

If you logon on the remote machine using the same domain account, can to
access the registry key? Also, please check if the user has full control to
the registry key and wasn't denied access to it.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Kevin Swanson]

KY,

Yeah... I can log on to the remote machine using my domain account, and get
full access to the registry. But I can't open HKLM using regedit from my
machine (same domain account) and connecting to the remote machine. I can see
the hive, but can't open it.

"Kevin Yu [MSFT]" wrote:

Hi Kevin,

If you logon on the remote machine using the same domain account, can to
access the registry key? Also, please check if the user has full control to
the registry key and wasn't denied access to it.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Kevin Yu [MSFT]]

Hi Kevin,

Looking at the nature of this issue, it would require intensive
troubleshooting which would be done quickly and effectively with direct
assistance from a Microsoft Support Professional through Microsoft Product
Support Services. You can contact Microsoft Product Support directly to
discuss additional support options you may have available, by contacting us
at 1-[phone] or by choosing one of the options listed at
http://support.microsoft.com/default...d=sz;en-us;top.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."