|
TABLE 3: AVAILABLE ACCESS PERMISSIONS ON REGISTRY KEYS |
| Access Right | What It Allows |
| Query Value | The ability to view or read all values under the current key |
| Set Value | The ability to change all values beneath the current key |
| Create Subkey | The ability to create new keys beneath the current one. |
| Enumerate Subkeys | The ability to view all subkeys beneath the current key |
| Notify | The ability to audit when a notification event happens on this key |
| Create Link | The ability to create a symbolic link within the current key. Symbolic links can only be created programmatically. |
| Delete | The ability to delete the current key |
| | Note: If there are subkeys to this key, they are also be deleted if you work with the Registry interactively. However, if an application is attempting to delete a key using the Registry API call RegDeleteKey, and the key contains subkeys, the delete operation fails. This is a function of the API call, rather than a security problem. |
| Write DAC | The ability to add an ACL to the current key. A Discretionary Access Control (DAC) is simply the defined set of ACEs on a given resource. DAC is the term for a list of ACEs that determine access to an object. No distinction is made between DACs applied by users and those applied by the system. |
| Write Owner | The ability to take ownership of the current Registry key |
| Read Control | The ability to view the security information for the current key (i.e., the ACL, auditing and ownership information) |
Windows IT Pro
Register
