Member Avatar for nanosani

How can I prevent a registry key from deletion ?? I want to have my application store passwords of the users in a registy key ... so I want to prevent users from deleting the registry key manually.

  • 4 Contributors
  • 4 Replies
  • 262 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by f1 fan

Dani AI

Generated

Short answer up front for : you cannot reliably stop the owner (or any user with Administrator / “take ownership” rights) from deleting a registry key. Administrators can take ownership and change permissions on any securable object, so ACLs only protect against non-privileged users. (learn.microsoft.com)

Practical approach instead of “prevent deletion”: make the secret useless if removed, and make casual deletion unlikely. Encrypt the secret with the OS-provided Data Protection API (DPAPI) or use the Windows Credential Manager so the OS handles encryption and key material. For managed code use System.Security.Cryptography.ProtectedData (wrapping CryptProtectData); for native code use CryptProtectData. For credentials that belong to the user, store in the user’s credential set via CredWrite/CredRead. Never store plaintext. (learn.microsoft.com)

Concrete workflow you can apply:

  • On install (running elevated) create a machine-level registry key under HKLM and set ACLs so only SYSTEM and Administrators have write; regular users get read-only. This reduces accidental deletion by normal users but not by admins.
  • Encrypt the actual secret with DPAPI before writing it to the registry (or store it with CredWrite instead).
  • If the app needs exclusive protection, run a small service under LocalSystem to access/decrypt the blob; the service can hide logic from normal user processes.
    Example (C# sketch — adapt and harden for production):
byte[] secret = Encoding.UTF8.GetBytes(password);
byte[] protectedBlob = ProtectedData.Protect(secret, null, DataProtectionScope.CurrentUser);
// Save protectedBlob to registry (installer/service should create key under HKLM)

Set registry ACLs with RegistrySecurity when creating the key. (learn.microsoft.com)

Notes and caveats: LSA “secret” APIs exist but Microsoft advises using DPAPI for general encryption; LSA is for specific secret objects only. A kernel driver to block deletes is complex, requires admin install/signing, and is overkill for almost all apps. If you need absolute control, the only practical options are hardware-backed keys (TPM/HSM) or keeping secrets server-side (so local deletion can’t remove the authoritative copy). (learn.microsoft.com)

(References above expand on the points raised by , and : ACLs and drivers make deletion harder, encryption/OS vaults protect the secret, but a determined admin can always remove or reconfigure local storage.)

Recommended Answers

All 4 Replies

Member Avatar for campkev

i don't think you can, nor do I think you should try. It's my registry and if I don't want something in there, I should be able to delete it.

Member Avatar for nanosani

So where should I store the password so that it may not be deleted by anyone.

Member Avatar for _r0ckbaer

well, to make registry access read only you could log into your windows without admin rights :P
another thing maybe would be to store that data in a file and fiddle with the security rights of it (right click file -> choose security tab) and modify these to have some (password protected) user have full rights on these and the rest (including you) have only read access :S

On the other hand what you wanna do there sounds quite impossible cause the currenty logged in user (which has the rights to install the application) will also have the corresponding file access rights on his system, maybe you wanna consider proctecting your file by some system driver, that monitors access to the file and prevents its deletion...

Member Avatar for f1 fan

Is it the users password or the application password? Its going to be tricky. Best place would be isolated storage and possibly some encryption but you wont stop a determined person finding it.

I would have to ask why you have the requirement. It is obviously not your pc so why wont you let me (for example) do whatever i want to my own pc? If it is crucial to have this information then store it where the average person cannot accidently delete it and make it known in the helpfile or whatever that they remove it at their own risk. You can only go so far at protecting things on other peoples pcs. It is their own after all. Its the same with anything else. I guess car manufacturers have hidden the fuel pump from the average driver, but if you are determined to remove it, dont complain when the car wont start.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.