How to restrict access to the registry from a remote computer

Summary
The Registry Editor supports remote access to the Windows registry. However, you can also restrict such access.


More information
On Windows NT 3.51, by default, any user can access the Registry during network connection. In Windows NT 4.0 and later versions, by default, only members of the Administrator group can access the Registry through the network.

Note: Some services must access the Registry to work properly. For example, if you add the corresponding registry key to the 3.51 system of the running directory copy, you must grant the Replicator account the permission to access the registry, as described later in this article.


Restrict network access to the registry
Warning improper use of the Registry Editor can cause serious problems and the operating system may need to be re-installed. Microsoft cannot guarantee that it can solve problems caused by improper registry use. You are at your own risk to use the Registry Editor.

Note: in Windows 2000 and later versions, Only Administrators and Backup Operators have access to the registry's default network. This part may not work in certain situations. To restrict network access to the registry, follow these steps to create the following registry key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurePipeServerswinreg

Note: REG_SZ
Value: Registry Server
The security permissions set in this item specify which users or groups can connect to the system to remotely access the registry. The default Windows installation defines this option and sets the "Access Control List" to restrict remote access to the registry, as shown below:
The Administrator has full control permissions.
By default, Windows only allows the Administrator to remotely access the registry. To allow users to remotely access the registry, the changes made to this item take effect only after the system is restarted.

To create a registry entry to restrict access to the registry, perform the following steps:
1. Start Registry Editor (Regedt32.exe) and locate the following subitem:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl
2. Click Add item in the edit menu.
3. Enter the following values:
Item Name: SecurePipeServers
Category: REG_SZ
4. Locate the following subitem:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurePipeServers
5. In the edit menu, click Add item.
6. Enter the following values:
Item Name: winreg
Category: REG_SZ
7. Locate the following subitem:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurePipeServerswinreg
8. Click Add Value on the editing menu.
9. Enter the following values:
Value Name: Description
Data Type: REG_SZ
String: Registry Server
10. Locate the following subitem.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurePipeServerswinreg
11. Select "winreg ". Click security, and then click permissions. Add the user or group to which the access permission is granted.
12. Exit Registry Editor and restart Windows.
13. If you want to change the list of users who can access the registry in the future, repeat steps 10-12.

Do not use access restrictions
Some services require remote access to the registry to work properly. For example, the directory replication program service and the background print program service need to access the Remote Registry when connecting to the printer through the network.

You can add the account name that runs the service to the access list of "winreg", or configure Windows to restrict access to certain items: list these items in the Machine or Users values under AllowedPaths.
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurePipeServerswinregAllowedPaths
Value: Machine
Value Type: REG_MULTI_SZ-multiple strings
Default data: SystemCurrentControlSetControlProductOptions
SystemCurrentControlSetControlPrintPrinters
SystemCurrentControlSetServicesEventlog
SoftwareMicrosoftWindows NTCurrentVersion
SystemCurrentControlSetServicesReplicator

Valid range: The valid path of a location in the registry.
NOTE: If
The listed locations do not have explicit access restrictions,
Allow the computer to access this location.

Value: Users
Value Type: REG_MULTI_SZ-multiple strings
Default data: (none)
Valid range: The valid path of a location in the registry.
NOTE: If
The listed locations do not have explicit access restrictions,
The user is allowed to access this location.

Windows 2000 and later versions are slightly different: Value: Machine
Numeric data: REG_MULTI_SZ-multiple strings
Default data: SystemCurrentControlSetControlProductOptions
SystemCurrentControlSetControlPrintPrinters
SystemCurrentControlSetcontrolServer Applications
SystemCurrentControlSetServicesEventlog
SoftwareMicrosoftWindows NTCurrentVersion

Value: Users-it does not exist by default.

--------------------------------------------------------------------------------

The information in this article applies:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Professional Edition
Microsoft Windows 2000 Datacenter Server
Microsoft Windows NT Workstation 3.51
Microsoft Windows NT Workstation 4.0 Developer Edition
Microsoft Windows NT Server 3.51
Microsoft Windows NT Server 4.0 Standard Edition