Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can a Service Write to Registry [HKLM]

I am writing a service for Windows Vista/7 which needs read/write/delete access to the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons

Are there any special considerations I must make just in case the target system has UAC enabled and the service must always run with administrator privileges?

The service is being written in VB.NET but C# code is welcome.


Thanks

like image 347
Alex Essilfie Avatar asked Aug 12 '10 14:08

Alex Essilfie


People also ask

Which takes precedence HKLM or Hkcu?

After testing, unless it's explicitly set at the system level via Group Policy, removing user editing ACL from the HKCU key, etc., HKCU will be honored over HKLM (simply adding the HKLM key doesn't cause precedence).

What is registry HKLM?

The HKEY_LOCAL_MACHINE, otherwise known as HKLM, is a Windows Registry tree that contains configuration data that is used by all users in Windows. This includes information about Windows services, drivers, programs that automatically run for every user, and general OS settings.

What is the purpose of register edit?

The Windows Registry Editor (regedit) is a graphical tool in the Microsoft Windows operating system (OS) that enables authorized users to view the Windows registry and make changes.


1 Answers

User Account Control (UAC) only applies to users who are logged on interactively. A windows service will have the full security token (as opposed to the restricted one UAC generates for non-standard account users) available to it.

If your service is running as either Administrator, a member of the Administrators group or LOCALSYSTEM, it should have unrestricted access to HKLM. The only thing you may need to be aware of is registry redirection for 32bit processes running on 64bit Windows.

like image 80
Rob Avatar answered Oct 12 '22 13:10

Rob