Re: User access rights within process on Vista

Are you asking simply because your application needs to be able to handle
access denial? If so, the best practice would be to go ahead and try to open
the key (RegOpenKey) and see if you get ERROR_ACCESS_DENIED.

If you literally mean you need to know what access will be granted, you
should use AccessCheck or one of the related APIs (the parameters are a
quite complicated). You should not attempt to implement all the rules
yourself, as you are quite likely to get it wrong and, even if you don't,
fail to take into account new features in future versions of Windows.

What do you mean it is not working in a non-elevated environment? Are you
aware of how that will affect your token and the access it gives you?

Paul

"Milan Tomes" <Milan Tomes@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:85DF5562-D0D9-4834-84AA-66BD0DB4E65D@xxxxxxxxxxxxxxxx
Hi,

how to determine user access rights for securable objects on Vista ? I've
tried GetTokenInformation to get user & user groups SIDs and
GetNamedSecurityInfo to get ACL. Then I go through the ACL and determine
access right. Unfortunately this is not working in non-elevated
environment.
So how to determine if my process have rights for e.g.
HKEY_USERS\.DEFAULT\Software registry key ???

Pls help me cause I'm already going crazy.

Thanks

Milan Tomes


.

Relevant Pages

  • Re: Effective User Rights on Key under System Service?
    ... >> registry key then try to open it for writing and if you get ... take the same ACL that exists on the registry key and simply copy it ... but you'd have to do that mapping somehow anyway. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: can registry be secured?
    ... hiding will be diffcult but Windows NT and upwards allow to set an ACL ... for the registry key so you can manage it with NT permissions. ... Jens ...
    (microsoft.public.vb.winapi)
  • Good summary of access rights in W2K/2003?
    ... I'm a bit confused at where and how user access rights can be set ... (NTFS, Active Directory, ACL, etc.) ...
    (microsoft.public.windows.server.general)