Repair Install Windows 10 with an In-place Upgrade  

Damn, stumped again. Can't get Powershell Get-Acl to work with this key. Doesn't seem to like the space in Windows NT, even when I surround the entire key in double quotes. What the heck am I doing wrong this time? This is from a Admin Powershell Window.

PS C:\Users\ztruk\PowerShellScripts> Get-Acl -Path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion" | Format-List
Get-Acl : Cannot find path 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion' because it does not exist.
At line:1 char:1
+ Get-Acl -Path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Curre ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (:) [Get-Acl], ItemNotFoundException
+ FullyQualifiedErrorId : GetAcl_PathNotFound_Exception,Microsoft.PowerShell.Commands.GetAclCommand

The path is correct:

C:\Users\ztruk>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion
EditionBuildBranch REG_SZ vb_release
EditionBuildLab REG_SZ 19041.vb_release.191206-1406
EditionBuildLabEx REG_SZ 19041.1.amd64fre.vb_release.191206-1406
EditionBuildNumber REG_DWORD 0x4a62
EditionBuildQfe REG_DWORD 0x276

Damn! The example even shows HKLM: but I tromped right over it.

Thanks all. Seems I'm my own worst enemy sometimes.

Anyway, shows Owner is TrustedInstaller and Administrators have Read access which is the info I was looking for without using regedit.

Code:

C:\Users\ztruk>Powershell Get-Acl -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion' ^| Format-List


Path   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
         NT\CurrentVersion\EditionVersion
Owner  : NT SERVICE\TrustedInstaller
Group  : NT SERVICE\TrustedInstaller
Access : NT AUTHORITY\SYSTEM Allow  -2147483648
         NT AUTHORITY\SYSTEM Allow  ReadKey
         BUILTIN\Administrators Allow  ReadKey
         BUILTIN\Administrators Allow  -2147483648
         BUILTIN\Users Allow  -2147483648
         BUILTIN\Users Allow  ReadKey
         NT SERVICE\TrustedInstaller Allow  268435456
         NT SERVICE\TrustedInstaller Allow  FullControl
         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadKey
         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  -2147483648
         S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 Allow
         ReadKey
         S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 Allow
         -2147483648
Audit  :
Sddl   : O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-3418522649-1831038044-185
         3292631-2271478464D:PAI(A;CIIO;GR;;;SY)(A;;KR;;;SY)(A;;KR;;;BA)(A;CIIO;GR;;;BA)(A;CIIO;GR;;;BU)(A;;KR;;;BU)(A;
         CIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;KA;;;S-1-5-80-956008885-341852264
         9-1831038044-1853292631-2271478464)(A;;KR;;;AC)(A;CIIO;GR;;;AC)(A;;KR;;;S-1-15-3-1024-1065365936-1281604716-35
         11738428-1654721687-432734479-3232135806-4053264122-3456934681)(A;CIIO;GR;;;S-1-15-3-1024-1065365936-128160471
         6-3511738428-1654721687-432734479-3232135806-4053264122-3456934681)

From a Command Prompt it should be:

Powershell Get-Acl -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion' ^| Format-List

Matthew Wai said:

The above syntax produced the following output:

Code:

REGINI: CreateKey (Windows Registry Editor Version 5.00) relative to handle (000000000) failed - 161
REGINI: Failed to load from file 'E:\Regini\Testing.txt' (161)

"Testing.txt" contains the following:

Code:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Testing"="\"C:\\Windows\\WORDPAD.exe"

The regini.exe input file I'm creating on the fly contains:

\Registry\machine\software\Microsoft\Windows NT\CurrentVersion\EditionVersion [1 6 9 17]

I was following info from here as a guide: [Windows Tip] Take Ownership (Permission) of Registry Keys from Command Line

Change Owner of File, Folder, Drive, or Registry Key in Windows 10

Scroll down to METHOD 3: Set Permissions on Registry Keys Using Built-in REGINI Command

Matthew Wai said:

If I understand correctly, one line of commands will do the job.

Code:

Echo \Registry\machine\software\Microsoft\Windows NT\CurrentVersion\EditionVersion [1 6 9 17]>%Temp%\T.txt & REGINI %Temp%\T.txt

What is the problem?

First, I don't want it on one line, I want readability. 2nd, it doesn't work. No permissions are changed.

Code:

Echo \Registry\machine\HARDWARE\Testing [0]>%Temp%\T.txt & REGINI %Temp%\T.txt

The above [0] will remove all permissions.

Don't know if that will work either and not willing to try it since I don't want to lose permissions to the key.

I believe the problem may be that you have to take ownership before trying to change the ACL permissions. I'll play with that and see.
This doesn't work with subinacl either so I again think ownership is the key.

SUBINACL /keyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion" /setowner=administrators /grant=administrators=f

It work if the key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows but it doesn't like Windows NT for some reason. I found this out by accident when I removed the double quotes from the key.

Okay, finally got it working. Had to switch to SETACL from Helge Klein instead of REGINI or SUBINACL.

Here is the working code:

Code:

:: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Written by Ztruker (TenForums.com/members/ztruker.html) 11/10/2020
:: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
@echo off
::
:: Restart as Admin if not already running as Admin
::
(Net session >nul 2>&1)||(PowerShell start """%~0""" -verb RunAs & Exit /B)
::
:: First backup existing key
::
(REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion" %temp%\EditionVersion.Backup.reg /y) || Goto Error
::
:: Use SETACL from Helge Klein to change ownership of key to administrators and give them full control
:: https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe/
::
(SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion" -ot reg -actn setowner -ownr "n:Administrators" -rec Yes) || Goto Error
(SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion" -ot reg -actn ace -ace "n:Administrators;p:full" -rec Yes) || Goto Error
Echo.
Echo Key now owned by Administrators with Full permissions.
::
:: Reg file is below. It is written to the %temp% directory as
:: Allow_20H2_Repair_Install_Keep_Everything.reg 
:: then imported into the registry using the REG IMPORT command.
::
SET ScriptDirectory=%~dp0
Set ScriptName=%~n0
Set ScriptExt=%~x0
SET "REGScript=%ScriptDirectory%%ScriptName%.REG"
(Echo Windows Registry Editor Version 5.00
Echo.
Echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion]
Echo "EditionBuildBranch"="vb_release"
Echo "EditionBuildLab"="19041.vb_release.19041.508"
Echo "EditionBuildLabEx"="19041.1.amd64fre.vb_release.19041.508"
Echo "EditionBuildNumber"=dword:00004a61
Echo "EditionBuildQfe"=dword:000001fc) > "%REGScript%"
::
:: Add entries to registry.
::
Echo.
Echo Updating registry
(REG IMPORT %REGScript%) || Goto Error
Echo.
Echo Registry key updated from:
type %temp%\EditionVersion.Backup.reg
Echo.
Echo to
Echo.
type %REGScript%
Goto Complete
::
:: Come here on any error
::
:Error
Echo An error occurred. Save the command prompt window text to examine.
Echo If needed, a backup of the registry key is in %temp%\EditionVersion.Backup.reg
Echo.
Echo ACL for key follows:
eCHO.
Powershell Get-Acl -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionVersion' ^| Format-List
::
:: Only exit from script. Require user to press Enter.
::
:Complete
pause