Windows Vista Forums
Vista Forums Home Join Vista Forums Windows 7 Forum Vista Tutorials Tags
Welcome to Windows Vista Forums. Our forum is dedicated to helping you find solutions with any problems, errors or issues you are experiencing with Windows Vista. The Vista forum also covers news and updates and has an extensive Windows Vista tutorial section that covers a wide range of tips and tricks.

Go Back   Vista Forums > Vista Newsgroups > Vista security

Vista - Remote registry request access denied

Reply
 
Old 10-07-2008   #1 (permalink)


Vista 32bit
 
 

Remote registry request access denied

I have a program that requests performance counter information from a remote Vista machine. In its simplest form it is just a single line of Visual Basic code:

PerformanceCounterCategory.Exists("Memory", remotemachinename)

If I run as an admin (admin accounts on both machines) everything is fine. But if i run as a standard account (non-Admin on both machines) I get an access denied error on "openHKPD". That is the hidden registry hive HKEY_PERFORMANCE_DATA. Anyone have ideas about why a standard account would fail? It does not fail if I run the request locally on the machine so the standard account has sufficient permission.

If I run from Vista to a remote XP machine I do not get this error so I am thinking it may have something to do with registry virtualization on Vista. Or it may have something to do with UAC except these are non-Admin accounts so UAC should not matter.

FYI Remote registry service is running and the registry key ....\securepipeservers\winreg has granted permission to the non-Admin account.

My System SpecsSystem Spec
Old 10-07-2008   #2 (permalink)
Mr. Arnold


 
 

Re: Remote registry request access denied


"DreamU" <guest@xxxxxx-email.com> wrote in message
news:1a2541f33b42dd3948311e89643722e0@xxxxxx-gateway.com...
Quote:

>
> I have a program that requests performance counter information from a
> remote Vista machine. In its simplest form it is just a single line of
> Visual Basic code:
>
> PerformanceCounterCategory.Exists("Memory", remotemachinename)
>
> If I run as an admin (admin accounts on both machines) everything is
> fine. But if i run as a standard account (non-Admin on both machines) I
> get an access denied error on "openHKPD". That is the hidden registry
> hive HKEY_PERFORMANCE_DATA. Anyone have ideas about why a standard
> account would fail? It does not fail if I run the request locally on the
> machine so the standard account has sufficient permission.
>
> If I run from Vista to a remote XP machine I do not get this error so I
> am thinking it may have something to do with registry virtualization on
> Vista. Or it may have something to do with UAC except these are
> non-Admin accounts so UAC should not matter.
Quote:

> FYI Remote registry service is running and the registry key
> ...\securepipeservers\winreg has granted permission to the non-Admin
> account.
>
What it really comes down to is that the user-id for the Standard user
account in not on the registry with proper access rights or it's not there
period on the remote machine, as opposed to the Administrators group is on
the registry entry when you are using an admin account. It's *access denied*
for the Standard user and its user-id.


My System SpecsSystem Spec
Old 10-07-2008   #3 (permalink)


Vista 32bit
 
 

Re: Remote registry request access denied

Let me elaborate on my earlier comment: when I say the command works when I run it locally that means I log in as that standard user with the exact same username and password (which exists on both the remote machine and the host). So, it does exist and because it runs fine locally there are no registry access issues with the standard user.

Now, even though it runs fine locally I did something a little crazy to try and troubleshoot: I specifically gave the standard user full control permission on CurrentControlSet\Services which is where the performance pointers are stored. So that local user was basically made equivalent to an Admin even though it already ran fine locally.

I think the issue is with remote HKPD access and becuase it is hidden I don't know how to grant permission. Secondly, there is something odd about Vista which is clearly applying a different rule/permission when run remotely as opposed to locally.

Edit: Also, I have logged in to XP machine as the standard user and run REGEDIT / Connect Network Registry and am allowed to successfully browse the registry on the Vista machine.

Last edited by DreamU; 10-07-2008 at 11:11 PM.. Reason: Add more information
My System SpecsSystem Spec
Old 10-07-2008   #4 (permalink)
Paul MontDenturesDropped


 
 

Re: Remote registry request access denied

DreamU wrote:
Quote:

> Let me elaborate on my earlier comment: when I say the command works
> when I run it locally that means I log in as that standard user with the
> exact same username and password (which exists on both the remote
> machine and the host). So, it does exist and because it runs fine
> locally there are no registry access issues with the standard user.
>
> Now, even though it runs fine locally I did something a little crazy to
> try and troubleshoot: I specifically gave the standard user full control
> permission on CurrentControlSet\Services which is where the performance
> pointers are stored. So that local user was basically made equivalent
> to an Admin even though it already ran fine locally.
>
> I think the issue is with remote HKPD access and becuase it is hidden I
> don't know how to grant permission. Secondly, there is something odd
> about Vista which is clearly applying a different rule/permission when
> run remotely as opposed to locally.
>
>
It makes sense to me that a Standard user cannot access the registry of
a remote machine, Vista is not XP. I guess that kind of access is denied
on Vista. You can look-up more information about this.

<http://www.vistax64.com/vista-account-administration/98216-when-standard-users-access-vista-registry-remotely-access-denied.html>
My System SpecsSystem Spec
Old 10-08-2008   #5 (permalink)


Vista 32bit
 
 

Re: Remote registry request access denied

Thanks for the link but that information is just plain wrong. Specifically, it says "A standard user cannot connect to the registry of a remote PC." This is not true, as a standard user on XP I can connect to a remote Vista and read every key I have tried. Now, I can't modify the remote registry but I certainly can connect. (P.S. This is through Regedit/Connect Network Registry)
My System SpecsSystem Spec
Old 10-08-2008   #6 (permalink)
Mr. Arnold


 
 

Re: Remote registry request access denied


"DreamU" <guest@xxxxxx-email.com> wrote in message
news:b8aaab5665b9c7ab06c01fe17fd33931@xxxxxx-gateway.com...
Quote:

>
> Thanks for the link but that information is just plain wrong.
> Specifically, it says "A standard user cannot connect to the registry of
> a remote PC." This is not true, as a standard user on XP I can connect
> to a remote Vista and read every key I have tried. Now, I can't modify
> the remote registry but I certainly can connect. (P.S. This is through
> Regedit/Connect Network Registry)
>
>
Maybe your attempt to access as Standard user is being redirected to another
area.

http://technet.microsoft.com/en-us/m.../cc160882.aspx

My System SpecsSystem Spec
Old 10-08-2008   #7 (permalink)


Vista 32bit
 
 

Re: Remote registry request access denied

Thanks for the link on Registry Virtualization. Ironically, virtualization allows standard user writes to occur where they used to fail under XP. So, my standard user would have more capability! I know I questioned virtualization in my initial thread but it is really a long shot. No only becuase it provides more power but also becuase I don't write to any registry keys in my program so I don't need the extended capability.
My System SpecsSystem Spec
Reply

Thread Tools


Similar Threads
Thread Forum
Access denied on the registry Vista security
Access Denied for Registry Entries Vista security
When standard users access Vista registry remotely, Access Denied Vista account administration
Registry - Access Denied Vista General
Access denied in registry with regedit Vista security


Vista Forums is an independent web site and has not been authorized,
sponsored, or otherwise approved by Microsoft Corporation.
"Windows Vista", the Start Orb, and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46