{"id":19403,"date":"2009-01-23T10:00:00","date_gmt":"2009-01-23T10:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2009\/01\/23\/why-cant-you-apply-acls-to-registry-values\/"},"modified":"2009-01-23T10:00:00","modified_gmt":"2009-01-23T10:00:00","slug":"why-cant-you-apply-acls-to-registry-values","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20090123-00\/?p=19403","title":{"rendered":"Why can&#8217;t you apply ACLs to registry values?"},"content":{"rendered":"<p>Someone wondered <a href=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2008\/01\/18\/7145021.aspx#7150078\"> why you can&#8217;t apply ACLs to individual registry values<\/a>, only to the containing keys.<\/p>\n<p> You already know enough to answer this question; you just have to put the pieces together. <\/p>\n<p> In order for a kernel object to be ACL-able, you need to be able to create a handle to it, since it is the act of creating the handle that performs the access check. <\/p>\n<p> Creating a handle to the value means that we would need a function like <code>RegOpenValue<\/code> and corresponding <code>RegQueryValueData<\/code> and <code>RegSetValueData<\/code> functions which take not a registry key handle but a registry value handle. <\/p>\n<p> And then you&#8217;ve basically come full circle. You&#8217;ve reinvented the 16-bit registry, where data was stored only in the tips of the trees. Just change <i>value<\/i> to <i>subkey<\/i> and you&#8217;re back where you started. <\/p>\n<p> What would be the point of adding an additional layer that just re-expresses what you had before, just in a more complicated way? <\/p>\n<p> Commenter bcthanks wondered why <a href=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2008\/01\/18\/7145021.aspx#7167391\"> we didn&#8217;t abandon values and just stored everything in subkeys, like the 16-bit registry did<\/a>. Well, if you want to do that, then more power to you. Though it would make it difficult for you to store anything other than <code>REG_SZ<\/code> data in the registry. If you wrote a <code>REG_BINARY<\/code> blob to the default value of a subkey, what should be returned if somebody called <code>RegQueryValue<\/code> which always returns a string? <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Someone wondered why you can&#8217;t apply ACLs to individual registry values, only to the containing keys. You already know enough to answer this question; you just have to put the pieces together. In order for a kernel object to be ACL-able, you need to be able to create a handle to it, since it is [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-19403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>Someone wondered why you can&#8217;t apply ACLs to individual registry values, only to the containing keys. You already know enough to answer this question; you just have to put the pieces together. In order for a kernel object to be ACL-able, you need to be able to create a handle to it, since it is [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/19403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=19403"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/19403\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=19403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=19403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=19403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}