Hello,

Some programs will write the same key over and over again; others will
delete a key, recreate it, change it, etc... The Windows system is one such
program.

Take a look at regmon <http://www.sysinternals.com/Utilities/Regmon.html>.
If one doesn't know the registry very well one should leave it alone unless
one has performed a lot of testing first. Regmon is a good tool that can
help out a lot.

Regards,

--
Jason Muskat | GCUX - de VE3TSJ
____________________________
TechDude
e. Jason (at) TechDude (dot) Ca [email concealed]
m. 416 .414 .9934

http://TechDude.Ca/

> From: Harlan Carvey <keydet89 (at) yahoo (dot) com [email concealed]>
> Date: Fri, 12 May 2006 10:25:12 -0700 (PDT)
> To: Jason Muskat <Jason (at) TechDude (dot) Ca [email concealed]>, <genius (at) cwgz (dot) net [email concealed]>,
> <focus-ms (at) securityfocus (dot) com [email concealed]>
> Subject: Re: Restricting Remote Registry Access
>
> Jason,
>
>> Simply set the permissions for the parts of the keys
>> you want to. Watch out,
>> the registry is used very oddly. You will most
>> likely break something.
>
> Can you elaborate? What do you mean that the Registry
> is "used oddly"?
>
> Thanks,
>
> Harlan
>
> ------------------------------------------
> Harlan Carvey, CISSP
> "Windows Forensics and Incident Recovery"
> http://www.windows-ir.com
> http://windowsir.blogspot.com
> ------------------------------------------

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]