How to write in a registry key own by TrustedInstaller

Question

In order to install a new property page into the Active Directory SnapIn, I need to write into the following registry key of W2K8 R2 (as documented by Microsoft)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns{E355E538-1C2E-11D0-8C37-00C04FD8FE93}\NodeTypes

This key is own by a special user called TrustedInstaller. I found a lots of thing on the NET arround that.

At the moment here is the way it works doing the following (user is member of administrator group):

1. I give the user the privilege to take ownership.
2. The user take ownership
3. The user write the registry
4. the user give ownership to the administrators group.

My project is full written in C# and there are two things that I don't like in the way I'am doing it.

• I use InteropServices to call Win32 AdjustTokenPrivileges API. Does anybody know a way of doing that in pure C# ?
• At the end TrustedInstaller is no longer the owner of the key, and I'am not able to give him ownership, he keeps the full control, but I don't want my server classified as corrupted after the installation of my snap-in.

So my question is : Do I miss something, is there a documented way to modify such a key which is documented as modifiable ?

There is a Stack overflow question existing about that, the answer say that TrustedInstaller ownership, means the key is part of system installation and not application installation. For me if Microsoft documents how to modify a key it's application installation.

Thanks in advance.

Clabber

Answer 1

So I found one of my problem.

When you want to take ownership on a resource you add to enable the SeTakeOwnershipPrivilege this allow you to change the owner SID. But the new Owner Sid must be in the caller’s token, plus, that Sid must have attribute SE_GROUP_OWNER. So in my case I was not able to change back SID owner to S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 (TrustedInstaller). I was just able to take ownership, or to give ownership to the group "Administrators". I discover that there is a king of work-around whereby you can assign any arbitrary user as the owner, even if its SID is not in the token. SeRestorePrivilege privilege that is granted to administrators and backup operators, but NOT enabled by default. Enbling it allow me to give back ownership to TrustedInstaller.

So it works doing the following (user is member of administrator group):

1. I give the user the privilege to take ownership and enable the privilege of restore
2. The user take ownership
3. The user write the registry
4. the user give ownership to the previous owner TrustedInstaller.

I use InteropServices to call Win32 AdjustTokenPrivileges API, and it seems to be the only way to do it in C#

I will soon post on my blog a small tool that allow to give back ownership to TrustedInstaller.

---

Edited : Sorry for the delay I just forget it, you can find the code on Gist.

Clabber

Any chance you have a blog post or sample code? I've been trying to get this to work for hours. – Sneakers

@Sneakers I finaly put the code on Gist, I hope it helps. – Clabber

Answer 2

If you use the Registry table in an MSI installer you should be able to write the entry without problems. This is because the installation process is performed under the TrustedInstaller account (you don't need to change ownership).

Edit: It seems that you are trying to write in a registry key that is under the Windows protection system. The TrustedInstaller account doesn't matter in this case.

Basically, a regular MSI cannot write in that key because it's protected by Windows. You will need to find another approach for installing the property page.

Consolidate

I try to do it using the registry entry of a MSI generated by a "deployement installation project" in Visual studio 10. I'am going to retry but in my first test it was not working. Do I have to specifiy something special in the table with Orca ? – Clabber

So I tested it again. here is the registry table of my MSI _2D2C089689924663A0BDAAE6CFE4E160 2 Software\Microsoft\MMC\SnapIns\{E355E538-1C2E-11D0-8C37-00C04FD8FE93}\NodeTypes\{3bcd9db8-f84b-451c-952f-6c52b81f9ec6} * C__2D2C089689924663A0BDAAE6CFE4E160 Are you sure of your assertion ? – Clabber

What happens during install? Did you create a log to see how the registry entry is handled? – Consolidate

Sorry, I don't know how to create a log of a MSI installation. – Clabber

Thanks Cosmin, Here is the result : WriteRegistryValues: Clé : \Software\Microsoft\MMC\SnapIns\{E355E538-1C2E-11D0-8C37-00C04FD8FE93}\NodeTypes\{3bcd9db8-f84b-451c-952f-6c52b81f9ec6}, nom : , valeur : MSI (s) (28:F0) [16:38:30:109]: SFC: Cannot create the following key due to windows protection: \Software\Microsoft\MMC\SnapIns\{E355E538-1C2E-11D0-8C37-00C04FD8FE93}\NodeTypes\{3bcd9db8-f84b-451c-952f-6c52b81f9ec6} I was executing with full administrator privilege. – Clabber

Sorry Cosmin, The modification I do is DOCUMENTED by Microsoft (see first line). More than that, it's not protected by windows, if I take ownership, it works. I'am quite sure that there is a CLEAN solution for that. – Clabber

It is my understanding that keys owned by TrustedInstaller fall under the Windows Resource Protection (WRP) policy of Windows (see msdn.microsoft.com/en-us/library/windows/desktop/…) and cannot be modified (unless doing something like taking ownership first, as other posters indicate). – Alkylation

Answer 3

If you run program as an administrator (don't forget to enable 'requireAdministrator' as the UAC execution level in the manifest) or any other user having SE_RESTORE_NAME privilege you can enable the privilage and then use RegCreateKeyEx with REG_OPTION_BACKUP_RESTORE flag. You can use the same flag in RegOpenKeyEx (see ulOptions parameter), but it is undocumented and I would recommend you better to use RegCreateKeyEx instead. The key handle returned can be used to set the value with respect of RegSetValueEx for example. In the way you will be able to set any registry key. If you additionally enable SE_BACKUP_NAME privilege you will be able to read any registry key (for example from HKEY_LOCAL_MACHINE\SECURITY or HKEY_LOCAL_MACHINE\SAM\SAM).

Silici