CODEWITHSUNDEEP
windowsinstallshield
MarioWu
MarioWu

Reputation: 73

Installshield - How can I overwrite HKEY_LOCAL_MACHINE registry?

I tried to change this reg key (and subkey, value) SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone in both hives, HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE

enter image description here

Even when using the same method, I can only overwrite this key in HKEY_CURRENT_USER. On HKEY_LOCAL_MACHINE, I can overwrite subkey but cant change this SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone reg value!

Setup.exe require Administrator Excution level already...

What is happening and how can I make it work?

ACL info:

Path   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone
Owner  : NT AUTHORITY\SYSTEM
Group  : NT AUTHORITY\SYSTEM
Access : BUILTIN\Users Allow  ReadKey
         BUILTIN\Users Allow  -2147483648
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Administrators Allow  268435456
         NT AUTHORITY\SYSTEM Allow  FullControl
         NT AUTHORITY\SYSTEM Allow  268435456
         CREATOR OWNER Allow  268435456
         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey
         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  -2147483648
         S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 Allow  ReadKey
         S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 Allow  -2147483648

Upvotes: 1

Views: 525

Answers (1)

Silverstorm
Silverstorm

Reputation: 15845

CapabilityAccessManager ConsentStore is by user, you couldn't do something similar not even importing a reg file in regedit after an UAC consent, because the path it is owned by SYSTEM.

It is for security reason. To do something similar you should compromise the default ownership of the path.

Upvotes: 1

Related Questions