reg_takeownership

@echo off &title AveYo's reg_takeownership snippet example - updated 2019.07.11
:: arguments order changed; added support for setting different owner in one go by giving a second sid

::AveYo: self-elevate passing args and preventing loop
set "args="%~f0" %*" & call set "args=%%args:"=\""%%"
reg query HKU\S-1-5-20>nul||(if "%?%" neq "y" powershell -c "start cmd -ArgumentList '/c set ?=y&call %args%' -verb runas" &exit)

set $=@echo -------------------------------------------------------------------- ^& echo.

::=================================
set "regkey=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\DefaultMediaCost"
::=================================

echo Allow read from current user [owner will be set to current user as well if owner arg is ommited]
for /f "tokens=2" %%s in ('whoami /user /fo list') do set CU=%%s
call :reg_takeownership "%regkey%" "ReadPermissions, ReadKey" Allow %CU%
rem can add >nul at the end of the above call to supress acl output
%$%

echo Deny changes from Administrators and set owner to SYSTEM
call :reg_takeownership "%regkey%" "SetValue, Delete" Deny S-1-5-32-544 S-1-5-18
%$%

echo Restore FullControl to Administrators and set owner to TrustedInstaller
for /f "tokens=3" %%s in ('sc showsid TrustedInstaller') do set TI=%%s
call :reg_takeownership "%regkey%" FullControl Allow S-1-5-32-544 %TI%
%$%

echo Done!
timeout /t -1 &exit/b

:reg_takeownership  key:"HKCU\Console" perm:"FullControl" access:"Allow" user:"S-1-5-32-544" owner(optional):"S-1-5-18"
set "pargs=$regkey='%~1'; $p='%~2'; $a='%~3'; $u='%~4'; $o='%~5';"
powershell -noprofile -c "%pargs%; $f=[io.file]::ReadAllText('%~f0') -split ':ps_reg_own\:.*';iex ($f[1]);" & exit/b
:ps_reg_own: [     pastebin.com/XTPt0JSC      AveYo: call :reg_takeownership "HKLM\MyKey" FullControl Allow S-1-5-18
$dll0='[DllImport("ntdll.dll")]public static extern IntPtr RtlAdjustPrivilege(int a,bool b,bool c,ref bool d);';
$nt=Add-Type -Member $dll0 -Name Nt -PassThru; foreach($i in @(9,17,18)){$null=$nt::RtlAdjustPrivilege($i,1,0,[ref]0)}
$root=$true; if($o -eq ''){$o=$u}; $rk=$regkey -split '\\',2; $key=$rk[1];
switch -regex ($rk[0]){ '[mM]'{$HK='LocalMachine'};'[uU]'{$HK='CurrentUser'};default{$HK='ClassesRoot'}; }
$usr=0,0,0; $sec=0,0,0; $rule=0,0,0; $perm='FullControl',$p,$p; $access='Allow',$a,$a; $s=$o,$u,'S-1-5-32-544';
for($i=0;$i -le 2;$i++){ $usr[$i]=[System.Security.Principal.SecurityIdentifier]$s[$i];
 $rule[$i]=[System.Security.AccessControl.RegistryAccessRule]::new($usr[$i], $perm[$i], 3, 0, $access[$i]);
 $sec[$i]=[System.Security.AccessControl.RegistrySecurity]::new(); }
function Reg_TakeOwnership { param($hive, $key, $root=$false);
 $reg=[Microsoft.Win32.Registry]::$hive.OpenSubKey($key,'ReadWriteSubTree','TakeOwnership'); $sec[2].SetOwner($usr[2]);
 $reg.SetAccessControl($sec[2]); if($root){ $reg=$reg.OpenSubKey('','ReadWriteSubTree','ChangePermissions');
  $acl=$reg.GetAccessControl(); $acl.SetAccessRuleProtection($false,$false); $acl.ResetAccessRule($rule[1]);
  $reg.SetAccessControl($acl); } $sec[0].SetOwner($usr[0]); $reg.SetAccessControl($sec[0]); }
Reg_TakeOwnership $HK $key $true; if($root){ $r=[Microsoft.Win32.Registry]::$HK.OpenSubKey($key);
 foreach($sk in $r.GetSubKeyNames()){try{ Reg_TakeOwnership $HK "$($key+'\\'+$sk)" $false}catch{} }}
Get-Acl "$($rk[0]+':\\'+$rk[1])" | fl
:ps_reg_own: ]