How to prevent writing to a specific registry key?

So changing registry strings is a pretty common tool around here and something ive done pretty comfortably for a long time.

Messing with registry permissions goes above my head and is quite a bit more risky. AFAIK with my limited knowledge ACL's and the like is quite a bit more risky.

I'd like to make this change as limited in scope as possible, and entirely reversible. Automatable via script if possible would be even better.

Dropbox. The bane of my existence as far as overlays go. Due to windows longstanding limit for overlay icons and its poor means of prioritization, i've had to go into the registry to manage them. 90% of the time this is due to dropbox updating and leapfrogging everything.

This fact in and of itself keeps me from enrolling in the dropbox beta builds as that would mean needing to self-modify even MORE frequently.

So in short, how can I remove write permissions to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers and then un-do it when/if the need arises?

yea I was able to DENY system permissions from the key, which did stop the strings from being written, the problem is somehow that also took the context menu out with it.

still searching for a better way even though dropbox could just disable the leapfrogging behavior and the problem would be solved. Or give an option for people to disable it, or disable some of the overlays you didnt want to use etc.

its pretty abhorrent considering windows can only accommodate 14 and dropbox ensures it takes 10 of them every time it updates but i digress.

yea i was looking for the option to disable only writes for example but I couldnt find it







the first image is what I was disabling. I assume i would need to change ownership and a bunch of humdrum to get to be able to modify it in the way youve displayed in your image. Problem is ive never done it and as such dont quite grasp the inheritance/subkey settings etc. I dont want to do something thats irreversible and if you screw up a registry key youre kinda SoL.

I did export it as a hive to cover that base, but i'd still like to understand what im getting into before i do it just because i have a fallback ;p

I would just want to change owner from SYSTEM to Users or? Would I check the "replace all child object permissions box" or would that be un necessary?

klepp0906 said:

So in short, how can I remove write permissions to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers and then un-do it when/if the need arises?

For testing only, run the following line of commands via an elevated Command Prompt after creating the Testing key:

Code:

Echo \Registry\machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Testing [0]>"%Temp%\T.txt" & REGINI "%Temp%\T.txt"

See whether you can write into the Testing key.

TairikuOkami said:

Disable Inheritance first, then you click on Show Advanced Permissions.

Do I Convert or Remove?


Also what would I do to reverse the process/put it back to the way it was as far as those converted or removed inheritance options go?

Thanks btw.
@Matthew Wai - im running the command now

Thanks for running it.