Need A Script !!

[DnFx91]

I just spent a day assigning registry rights, one at a time, in order to delete some keys that were preventing the USB from initializing on my brother's pc. Of course i just wanted to reinstall and start again but didnt really want to deal with redownloading all his stuff. I got it working in the end, but got me thinking that someone out there has made an easier and much less tedious way of assigning ownership of a bunch of regkeys to the admin, and then deleting them while also enumerating all the subkeys. It was fucking torture, i would get to the last key in the section, give myself ownership, and then 30 more subkeys appear inside it !!!!

 

Has anyone found a way to make this easier ?

[mehtaman]

Found this on Goolge: https://www.remkoweijnen.nl/blog/2012/01/16/take-ownership-of-a-registry-key-in-powershell/

 

You would need to change "DesktopBackground\Shell\Display" to your keys I guess, or maybe the whole $Key line would need tweaking to your needs.

$definition = @"
using System;
using System.Runtime.InteropServices;
 
namespace Win32Api
{
 
public class NtDll
{
[DllImport("ntdll.dll", EntryPoint="RtlAdjustPrivilege")]
public static extern int RtlAdjustPrivilege(ulong Privilege, bool Enable, bool CurrentThread, ref bool Enabled);
}
}
"@
 
Add-Type -TypeDefinition $definition -PassThru
 
$bEnabled = $false
 
# Enable SeTakeOwnershipPrivilege
$res = [Win32Api.NtDll]::RtlAdjustPrivilege(9, $true, $false, [ref]$bEnabled)
 
$key = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("DesktopBackground\Shell\Display", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)
$acl = $key.GetAccessControl()
$acl.SetOwner([System.Security.Principal.NTAccount]"Administrators")
$key.SetAccessControl($acl)

Save the below as a powershell script (extension .PS1)

Right click the file and select run with powershell

 

You might get errors and need to run this to allow custom scripts:

Set-ExecutionPolicy ByPass

[DnFx91]

1 hour ago, mehtaman said:

Found this on Goolge: https://www.remkoweijnen.nl/blog/2012/01/16/take-ownership-of-a-registry-key-in-powershell/

 

You would need to change "DesktopBackground\Shell\Display" to your keys I guess, or maybe the whole $Key line would need tweaking to your needs.

$definition = @"
using System;
using System.Runtime.InteropServices;
 
namespace Win32Api
{
 
public class NtDll
{
[DllImport("ntdll.dll", EntryPoint="RtlAdjustPrivilege")]
public static extern int RtlAdjustPrivilege(ulong Privilege, bool Enable, bool CurrentThread, ref bool Enabled);
}
}
"@
 
Add-Type -TypeDefinition $definition -PassThru
 
$bEnabled = $false
 
# Enable SeTakeOwnershipPrivilege
$res = [Win32Api.NtDll]::RtlAdjustPrivilege(9, $true, $false, [ref]$bEnabled)
 
$key = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("DesktopBackground\Shell\Display", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)
$acl = $key.GetAccessControl()
$acl.SetOwner([System.Security.Principal.NTAccount]"Administrators")
$key.SetAccessControl($acl)

Save the below as a powershell script (extension .PS1)

Right click the file and select run with powershell

 

You might get errors and need to run this to allow custom scripts:

Set-ExecutionPolicy ByPass

thanks for the reply, we tried this one, but it didnt work because it doesn't recursively grant rights, this script will try to unlock the "top" key, then realise it needs to unlock the subkeys first, but then doesnt go back to unlock the root key, so it does try, but ultimately fails, and still leaves me keys to manually take ownership of and delete