Jesper

> > check the ACL on
> > the key in HKLM. There are areas that ordinary users can write to still.
>
> OK - I hadn't got this at all. When my program is installed (for historical
> reasons) the registry key for the application (i.e. the application subkey
> within the company subkey, within HKLM\Software) is given Full Control
> permission to Everyone, and this is inherited by all of its sub-keys.

That's why it is not getting virtualized. If Everyone already has
permissions the app writes fine to that area.

> So let me get this right - does this mean I don't need to bother about any
> of this UAC stuff? That because I've given everyone permission to write to
> my key anyway, I can carry on as normal with no problems? It just seems
> counter to everything Microsoft seems to be pushing for...

It is counter to everything Microsoft has been pushing for. Applications
should not grant Everyone permission to modify global application settings
unless they really want any user to be able to modify how the application
works for any other user. Depending on what data the app stores in the
registry, that could get really bad. For instance, an app may specify
settings that cause code to get run. In that case a low-privileged user could
replace the code that gets run with malicious code. When a high-privileged
user runs the app the malicious code executes. It depends on the application
and on whether the computer is multi or single user how bad this is.