Remove the "Deny" (permission) rule from the "UserChoice" key in the registry through C #

Question

I am working on file associations. I determined that there is a key called UserChoice in:

 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\[ext]. 

I managed to read and write the UserChoice key, provided that I create it and that it has not yet been created by Windows. However, if the UserChoice key UserChoice already been created by Windows, then I need to run as Administrator to gain access to the key. My ultimate goal is to remove the UserChoice key.

I noticed that Windows places the Deny rule on the UserChoice key, which prevents me from deleting this key. If I can remove this rule, I believe that I will remove the UserChoice key. Here is the code I tried:

 public static void ShowSecurity(RegistryKey regKeyRoot, string user) { RegistrySecurity security = regKeyRoot.GetAccessControl(AccessControlSections.All); foreach (RegistryAccessRule ar in security.GetAccessRules(true, true, typeof(NTAccount))) { if (ar.IdentityReference.Value.Contains(User) && ar.AccessControlType.ToString().ToLower() == "deny") { security.RemoveAccessRuleSpecific(ar); regKeyRoot.SetAccessControl(security); } } } 

When Windows creates a UserChoice key, it adds a security rule for the current Type Deny user ; Resolution: special . This rule is not inherited and applies only to the UserChoice key.

With some startup and startup as an administrator, I can access this RegistryAccessRule . However, even as an administrator, I cannot delete this rule. I read somewhere in my research that there is no software way to do this. I can remove this rule through RegEdit. I can also remove the UserChoice key using the file type manager from NirSoft. Therefore, I suppose there is a way to do this.

Summary: Is there a way to remove the Deny rule so that I can remove the UserChoice key?

Answer 1

The example of your code and the recommendations suggested in lead me to a solution to overcome the security setting that Windows puts in the UserChoice key, which allowed me to delete this key.

My solution assumes that the UserChoice key UserChoice present in the HKEY_CURRENT_USER ( HKCU ) bush. In this case, the user has the UserChoice key and, therefore, has the necessary privileges to change the security settings on this key and ultimately delete it. (This means that the user should not be a member of the Administrators group.)

The extensionKey parameter of this method is the parent key of the UserChoice key.

 static void DeleteUserChoiceKey(RegistryKey extensionKey) { const string userChoiceKeyName = "UserChoice"; using (RegistryKey userChoiceKey = extensionKey.OpenSubKey(userChoiceKeyName, RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.ChangePermissions)) { if (userChoiceKey == null) { return; } string userName = WindowsIdentity.GetCurrent().Name; RegistrySecurity security = userChoiceKey.GetAccessControl(); AuthorizationRuleCollection accRules = security.GetAccessRules(true, true, typeof(NTAccount)); foreach (RegistryAccessRule ar in accRules) { if (ar.IdentityReference.Value == userName && ar.AccessControlType == AccessControlType.Deny) { security.RemoveAccessRuleSpecific(ar); // remove the 'Deny' permission } } userChoiceKey.SetAccessControl(security); // restore all original permissions // *except* for the 'Deny' permission } extensionKey.DeleteSubKeyTree(userChoiceKeyName, true); } 

Answer 2

Quick thought. Does it work if you take ownership of regKey before changing the rules on it.

Answer 3

 public static void ShowSecurity(RegistryKey regKeyRoot, string user) { regKeyRoot.OpenSubKey("", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.ChangePermissions); RegistrySecurity security = regKeyRoot.GetAccessControl(AccessControlSections.All); security.SetGroup( new NTAccount("Administrators") ); security.SetOwner( new NTAccount("ali") ); //Your account name security.SetAccessRuleProtection(true, false); regKeyRoot.SetAccessControl(security); //--------- foreach (RegistryAccessRule ar in security.GetAccessRules(true, true, typeof(NTAccount))) { if (ar.IdentityReference.Value.Contains(User) && ar.AccessControlType == AccessControlType.Deny ) security.RemoveAccessRuleSpecific(ar); } regKeyRoot.SetAccessControl(security); }