c# - Secure a registry key via ACL to remove all access to non administrators -

I am trying to lock a registry key with some important information that should be accessible to the client machine, I do not want to be a non administrator for accessing this key if you are an administrator then you will already make more damage than what you are storing in the key.

What I am currently doing is this:

  // Only allow access to administrators and deny all others rights to System.Security. AccessControl.RegistrySecurity acl = New System Security. AccessControl.RegistrySecurity (); Acl.AddAccessRule (New System Security. AccessControl.RegistryAccessRule ("Admin", System.Security.AccessControl.RegistryRights.FullControl, System.Security.AccessControl.AccessControlType.Allow)); Acl.AddAccessRule (New System Security. AccessControl.RegistryAccessRule ("Everyone", System.Security.AccessControl.RegistryRights.FullControl, System.Security.AccessControl.AccessControlType.Deny)); // Prevent access to legacy from accessible software or key to access to the company. Acl.SetAccessRuleProtection (true, false); MyKey.SetAccessControl (ACL);  

If I am right then it will refuse to access everyone, allow anyone to explicitly log in to the Administrator group and stop applying all the hereditary permissions by applying to my key ? I should know that before I will do ACL before screwing up the key, as if I could not remove it. Should I set the key owner as an Administrator group too?

PS: It is very important that the key can also be read as non-administrator, not only has changed.

"post-text" itemprop = "text">

Be very careful with refusing rules - they are only a few of the essentials.

If ACLs are to provide only AC administrators with access to those that you want them to do, then no one else will have access to key because ACE does not have access.

This is not clear from the document for AddAccessRule () if it will guarantee that a new rule (or ACE) is added to the end of the ACL or not to be the case Chances are, but if this happens and your ACE does not get denied then ACE ends before giving access to the administrator, then refuses AC refusal to use one (access to the first system Looking at aca Once it does reject the grant, which hit the first AC or reject). This is the reason that the use of denial of ACE can be difficult and since ACL does not explicitly allow, then admission check causes failure, you usually only need to specify which one Access is allowed.

You probably want to make sure that the owner does not have access to any key (or whatever thing) to the administrator group - but an owner always has the right to change the ACL (if You think about it for a moment).