How do I restrict access to REGEDIT to regular User?

macster2075 said:

right.. as I mentioned on my previous post. Doing that actually disables access to regedit to everyone including admin accounts. I do not want to do that. I would like for it to prompt me for the admin password when I try to access it when logged in as a regular user...the same way gpedit.msc is setup.... I cannot access gpedit.msc as a regular user unless I enter the admin password.

You should be able to change the enforcement policy to users only

Policy Enforcement Options

There are two policy enforcement options that influence the behavior of a software restriction policy. The following options define how software restriction policies are applied for all files, including signed files:

Apply software restriction policies to the following: All files. This option includes dynamic-link libraries (DLLs).

Apply software restriction policies to the following users: All users except local administrators. This option prevents the software restriction policies from applying to local administrators.

macster2075 said:

How would do this? and why isn't this done by default?.. regular users should NEVER be allowed to have access to regedit.

It's in the actual "Software Restriction Policies" folder in GPedit Right click "enforcement" and select properties.

Don't feel like experimenting on my machine but wouldn't limiting Admin rights prevent registry changes? In other words, a user who doesn't have admin rights shouldn't be able to edit the registry.

Or are you trying to limit those who have admin rights?

macster2075 said:

Not at all..what I am saying is that regular user accounts that do NOT have admin rights have access and are able to edit regedit.exe.

Hmmm.... that's weird. I would have thought this access limited by privileges set.

What I am trying to do is force regular users to be prompted to enter the ADMIN password in order to open regedit.exe...I am NOT trying to disable it completely from regular users.

Got it. BTW for clarity.... who are "regular users"? Do they have admin rights?. I know you indicate above, regular users don't have admin rights, but...

I have never seen this before in any other Windows OS.. regular user accounts have never been able to open regedit.exe without first entering the admin password.

Why I'm surprised Windows 10 would allow it. We are talking about Windows 10, right?

Also, which version of Windows 10 do you have - Home, Pro, Enterprise/Education?

My reply in red.

Well I expect this anyway since I've got admin rights. But I get your point. Anyway I've go no suggestions at this moment. Was just curious.

Let us know what you find.

Peace

macster2075 said:

This is the way I have the settings right now.. they look to me as if it should be asking for admin credentials when a regular user tries to open regedit.. am I right, or do I need to change anything here?

That would block the software (in additional rules etc) from running. full stop. As you have blocked all users including Admin. why would it bring up an admin prompt for software admin can't run? you would need to exclude admins. and retry.

As for "standard users" running configuration software as per Microsoft : Standard accounts can run most software and are allowed to change system and account settings.

you are ideally looking for a "limited user account" (domain/enterprise features) or a "Child account" (as linked child accounts can be very limited as to what they can execute)