{"id":10223,"date":"2019-07-07T09:14:41","date_gmt":"2019-07-07T09:14:41","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=10223"},"modified":"2020-11-24T02:05:05","modified_gmt":"2020-11-24T02:05:05","slug":"take-ownership-registry-key-permissions-command-line-acl","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/take-ownership-registry-key-permissions-command-line-acl\/","title":{"rendered":"Take Ownership of Registry Key &#038; Assign Permissions Using Command-line"},"content":{"rendered":"<p>We&#8217;ve seen how to use the Registry Editor (regedit.exe) to change <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-take-ownership-of-registry-keys-and-assign-full-permissions\/\">ownership of a registry key<\/a> and subkeys. This article tells you how to change registry key ownership and grant permissions using the command-line.<\/p>\n<p>Windows has the takeown.exe and icacls.exe console utilities to <a href=\"https:\/\/www.winhelponline.com\/blog\/take-ownership-of-file-or-folder\/\">change file\/folder ownership<\/a> and permissions, but there are no such built-in tools for changing the registry key ownership using command-line. You&#8217;ll need a third-party tool named <strong>SetACL<\/strong> for the task.<\/p>\n<p><!--more--><\/p>\n<div class=\"qt\">\n<h4>SetACL: Command-line arguments<\/h4>\n<p>Before proceeding, let&#8217;s see the command-line syntax for changing file\/registry ownership and permissions using SetACL.<\/p>\n<pre>SetACL -on objectname -ot objecttype -actn action<\/pre>\n<ul>\n<li><code>-on<\/code>: Specify the path to the object SetACL should operate on (e.g., file, registry key, network share, service, or printer).<\/li>\n<li><code>-ot<\/code>: Specify the object type. To change ownership or permissions for a file or folder, use the object type <code>file<\/code>. For registry keys, use the object type <code>reg<\/code><\/li>\n<li><code>-actn<\/code>: Specify the action as to what should SetACL do against the object specified. For taking ownership, set the action as <code>setowner<\/code>. To change permissions, set the action as <code>ace<\/code>.<\/li>\n<\/ul>\n<p><em>(See <a href=\"https:\/\/helgeklein.com\/setacl\/documentation\/command-line-version-setacl-exe\/\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">SetACL documentation<\/a> for the full list of objects, types, and supported actions.)<\/em><\/p>\n<\/div>\n<h2>Take Ownership of Registry Key &amp; Assign Permissions Using Command-line<\/h2>\n<p>To change registry key ownership and permissions using SetACL:<\/p>\n<ol>\n<li>Download <a href=\"https:\/\/helgeklein.com\/download\/#setacl\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">SetACL<\/a>, unzip the contents to a folder.<\/li>\n<li>Copy the appropriate version of <code>setacl.exe<\/code> (32-bit vs 64-bit) of the tool to a folder &#8212; e.g., <code>d:\\tools<\/code>.<\/li>\n<li>Let&#8217;s say you want to change ownership of the registry branch <code>HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}<\/code> and to grant the <code>Administrators<\/code> group full control permissions. Run these two commands from an <a href=\"https:\/\/www.winhelponline.com\/blog\/open-elevated-command-prompt-windows\/\">admin Command Prompt<\/a> window:\n<pre>SetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn setowner -ownr \"n:Administrators\"\r\nSetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn ace -ace \"n:Administrators;p:full\"<\/pre>\n<figure id=\"attachment_10224\" aria-describedby=\"caption-attachment-10224\" style=\"width: 689px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10224 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/take-ownership-registry-command-line.png\" alt=\"take ownership registry command-line - setacl\" width=\"699\" height=\"237\" \/><figcaption id=\"caption-attachment-10224\" class=\"wp-caption-text\">SetACL: Change Ownership of a Registry key &amp; assign Full Permissions<\/figcaption><\/figure>\n<ul>\n<li>The 1st command sets <code>Administrators<\/code> group as the owner of the key<\/li>\n<li>The 2nd command assigns the <code>Administrators<\/code> group Full Control permissions for the key.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>The <code>Administrators<\/code> group owns the key and its subkeys, and also has full control permissions, which you can check using the Registry Editor.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-10226\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/take-ownership-registry-command-line-administrators.png\" alt=\"take ownership registry command-line - setacl administrators\" width=\"700\" height=\"135\" \/><\/p>\n<hr \/>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/information-icon.png\" alt=\"\" width=\"48\" height=\"48\" class=\"alignright size-full wp-image-9189\" \/><strong>Important:<\/strong> For changing the ownership and permissions for <u>this key and subkeys<\/u>, add the <code><strong>-rec Yes<\/strong><\/code> argument at the end. See <a href=\"#recursive\">illustration below<\/a> for more information.<\/p>\n<hr \/>\n<h3>Error when changing registry key permissions?<\/h3>\n<p>SetACL reports the following error when attempting to change the permissions for a file\/folder or a registry key for which you don&#8217;t have access to. To prevent this error, make sure you first take ownership of the key before changing its permissions.<\/p>\n<pre class=\"err\">\r\nSetACL finished with error(s):\r\nSetACL error message: The call to SetNamedSecurityInfo () failed\r\nOperating system error message: Access is denied.\r\n<\/pre>\n<h3><a id=\"recursive\"><\/a>Take Ownership &amp; Assign Permissions Recursively (this key &amp; subkeys)<\/h3>\n<p>To change ownership and grant full control permission (to <code>Administrators<\/code>) for the specified key <strong>along with its subkeys<\/strong>, include the <code>-rec Yes<\/code> switch at the end, as given below:<\/p>\n<pre>SetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn setowner -ownr \"n:Administrators\" -rec Yes\r\nSetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn ace -ace \"n:Administrators;p:full\" -rec Yes<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/take-ownership-registry-command-line-recursively.png\" alt=\"take ownership registry command-line - setacl trustedinstaller\" width=\"699\" height=\"300\" class=\"alignnone size-full wp-image-10227\" \/><\/p>\n<h4>Set TrustedInstaller as the owner<\/h4>\n<p>To set <code>TrustedInstaller<\/code> as the owner of the above registry key and assign it full control permissions recursively, use the same command-line syntax. You only need to change the account\/group name. Here are the commands you need to run this time:<\/p>\n<pre>SetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn setowner -ownr \"n:nt service\\trustedinstaller\" -rec Yes\r\nSetACL.exe -on \"HKEY_CLASSES_ROOT\\CLSID\\{D63B10C5-BB46-4990-A94F-E40B9D520160}\" -ot reg -actn ace -ace \"n:\"nt service\\trustedinstaller\";p:full\" -rec Yes<\/pre>\n<p>After running the above command sets <code>TrustedInstaller<\/code> (<code>NT SERVICE\\TrustedInstaller<\/code>) as the owner of the key and subkeys.<\/p>\n<h3><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-10225\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/take-ownership-registry-command-line-trustedinstaller.png\" alt=\"take ownership registry command-line - setacl trustedinstaller\" width=\"700\" height=\"176\" \/><\/h3>\n<h2>Additional Information<\/h2>\n<ul>\n<li><strong>Microsoft&#8217;s SubInACL: <\/strong>There is also another console tool named SubInACL released by Microsoft during the Windows XP-era. It&#8217;s part of the Windows XP\/2003 Resource Kit Tools. SubInACL can be used to set ownership and permissions for files\/folders and registry. However, as SubInACL has been discontinued by Microsoft and it defaults to 32-bit file and registry paths (on Windows 64-bit systems) which makes it unusable in 64-bit versions of Windows in some situations.<\/li>\n<li><strong>Microsoft&#8217;s Regini.exe: <\/strong>You have another built-in console tool named regini.exe which lets you change the registry permissions using a text-based file. However, regini.exe can&#8217;t change the ownership of a registry key. For more information on regini.exe, open a Command Prompt window and type <code>regini.exe \/?<\/code><\/li>\n<li><strong>Helge Klein&#8217;s SetACL<\/strong> is widely recommended tool and it certainly has filled the void left by SubInACL and also addresses the shortcomings of <code>regini.exe<\/code>. SetACL can do many more things than what&#8217;s discussed in this article.<\/li>\n<\/ul>\n<p>See SetACL documentation for more details: <a href=\"https:\/\/helgeklein.com\/setacl\/documentation\/command-line-version-setacl-exe\/\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">SetACL Command Line-Version (SetACL.exe) &#8211; Syntax and Description<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We&#8217;ve seen how to use the Registry Editor (regedit.exe) to change ownership of a registry key and subkeys. This article tells you how to change registry key ownership and grant permissions using the command-line. Windows has the takeown.exe and icacls.exe console utilities to change file\/folder ownership and permissions, but there are no such built-in tools &#8230; <a title=\"Take Ownership of Registry Key &#038; Assign Permissions Using Command-line\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/take-ownership-registry-key-permissions-command-line-acl\/\" aria-label=\"Read more about Take Ownership of Registry Key &#038; Assign Permissions Using Command-line\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6,7],"tags":[441],"class_list":["post-10223","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows","tag-registry"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":264,"url":"https:\/\/www.winhelponline.com\/blog\/take-ownership-of-file-or-folder\/","url_meta":{"origin":10223,"position":0},"title":"Change Ownership of a File or Folder Using Takeown Command-Line Tool","author":"Ramesh","date":"May 3, 2008","format":false,"excerpt":"Every file or folder in an NTFS volume has an owner. Certain system files are owned by TrustedInstaller, some by SYSTEM account, and others by the \"Administrators\" group. If a user creates a file or folder, that user is usually the owner of the file or folder. The owner is\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"Take Ownership using command-line takeown.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/takeown-cmd.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/takeown-cmd.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/05\/takeown-cmd.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":19520,"url":"https:\/\/www.winhelponline.com\/blog\/view-edit-service-permissions-windows\/","url_meta":{"origin":10223,"position":1},"title":"How to View and Modify Service Permissions in Windows","author":"Ramesh","date":"October 25, 2020","format":false,"excerpt":"Summary: This article explains the various methods to view the permissions for any Service in Windows. It also covers the tools and methods to modify the service permissions easily. Just as file system objects and registry keys have permissions, each service in Windows can have a set of permissions. The\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"psservice64 view service permissions","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/psservice-view-service-permissions.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/psservice-view-service-permissions.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/psservice-view-service-permissions.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1505,"url":"https:\/\/www.winhelponline.com\/blog\/how-to-take-ownership-of-registry-keys-and-assign-full-permissions\/","url_meta":{"origin":10223,"position":2},"title":"Take Ownership of a Registry Key And Assign Full Permissions","author":"Ramesh","date":"August 28, 2015","format":false,"excerpt":"Certain areas of the Windows registry cannot be accessed due to the Permissions assigned (or lack thereof) for those keys. For instance, some registry keys are owned by the LocalSystem account, and some are owned by TrustedInstaller. There are legitimate cases where you need to access a registry key to\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/10\/reg-key-error-delete.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":19471,"url":"https:\/\/www.winhelponline.com\/blog\/cannot-import-reg-not-all-data-was-successfully\/","url_meta":{"origin":10223,"position":3},"title":"Cannot import .REG file; Not all data was successfully written to registry","author":"Ramesh","date":"October 22, 2020","format":false,"excerpt":"Sometimes, when applying the registry settings using a .reg file, you may get one of the following errors: Cannot import file.reg: Not all data was successfully written to the registry. Some keys are open by the system or other processes, or you have insufficient privileges to perform this operation. Cannot\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"cannot import .reg file - error accessing registry","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":4021,"url":"https:\/\/www.winhelponline.com\/blog\/take-ownership-via-right-click-context-menu-add\/","url_meta":{"origin":10223,"position":4},"title":"Take Ownership of File or Folder via Right-click Menu","author":"Ramesh","date":"September 6, 2016","format":false,"excerpt":"We saw how to Take Ownership of a file or folder using the takeown.exe command-line tool. You can add the \"Take Ownership\" command to the right-click menu to make it easier to access. Add \"Take Ownership\" to the right-click menu Download take_ownership_context_menu.zip, unzip the file, and run the enclosed REG\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"take ownership - success - check status","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/takeown_results_cmd.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/takeown_results_cmd.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/takeown_results_cmd.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/09\/takeown_results_cmd.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":10139,"url":"https:\/\/www.winhelponline.com\/blog\/fix-windows-update-error-0x80070422-in-windows-10\/","url_meta":{"origin":10223,"position":5},"title":"Error 0x80070422 in Windows Update and Store","author":"Ramesh","date":"July 3, 2019","format":false,"excerpt":"When you open Settings and check for updates on your Windows 10 or 11 computer, the error 0x80070422 appears. Here is the entire error message: There were some problems installing updates, but we'll try again later. If you keep seeing this and want to search the web or contact support\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"store error 0x80070422","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/store-error-0x80070422-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/store-error-0x80070422-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/store-error-0x80070422-1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/store-error-0x80070422-1.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/10223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=10223"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/10223\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=10223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=10223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=10223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}