View difference between Paste ID: VyJLM1Qk and XTPt0JSC

-@title reg_own snippet usage - 2020.11.07
+@echo off &title AveYo's reg_takeownership snippet example - updated 2019.07.11
-:: AveYo: csc-less; support any hive; recursively add or delete rights and try to preserve owner; still 12 lines
+:: arguments order changed; added support for setting different owner in one go by giving a second sid
-:: Changelog: abort early if key not found, print cmdline for examples. thanks pastebin for restoring this gem
+
-:: To those reporting it: this provides legitimate registry permission tasks to admins, similar to built-in regini
+::AveYo: self-elevate passing args and preventing loop
-@echo off & color 07
+set "args="%~f0" %*" & call set "args=%%args:"=\""%%"
-echo Usage:
+reg query HKU\S-1-5-20>nul||(if "%?%" neq "y" powershell -c "start cmd -ArgumentList '/c set ?=y&call %args%' -verb runas" &exit)
-echo call :reg_own "key" all[""=key-only] user[""=Administrators] owner[""=Original] access[""=Allow] perm[""=FullControl]
+
-echo;
+set $=@echo -------------------------------------------------------------------- ^& echo.
-echo Denying permissions works fine for a specific key, but when doing it recursively you need to be smart about it,
+
-echo as you could get a "cart before the horses" situation, denying yourself making further permission changes to subkeys.
+::=================================
-echo Never use FullControl with deny permissions recursively. WriteKey will deny "Read Control" so dont use that either.
+set "regkey=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\DefaultMediaCost"
-echo Instead, deny write permissions explicitly: "SetValue,CreateSubkey,CreateLink,Delete,ChangePermissions,TakeOwnership"
+::=================================
-echo Also advised not to set deny permissions for Everyone sid, but use instead non-global individual users or groups
+
-echo;
+echo Allow read from current user [owner will be set to current user as well if owner arg is ommited]
 for /f "tokens=2" %%s in ('whoami /user /fo list') do set CU=%%s
-:::: Define TI sid (TrustedInstaller)
+call :reg_takeownership "%regkey%" "ReadPermissions, ReadKey" Allow %CU%
-for /f "tokens=3" %%a in ('sc.exe showsid TrustedInstaller') do set TI=%%a >nul
+rem can add >nul at the end of the above call to supress acl output
-:::: Define USER sid before asking for elevation since it gets replaced for limited accounts
+%$%
-set _=call "%~f0" %* &if "%USER%"=="" for /f "tokens=2" %%u in ('whoami /user /fo list') do set USER=%%u
+
-:::: Ask for elevation passing USER and any batch arguments - ps also enables debug priviledge unlike vbs
+echo Deny changes from Administrators and set owner to SYSTEM
-reg query HKU\S-1-5-19>nul 2>nul||(powershell -nop -c start cmd -args '/d/x/q/rset USER=%USER%^&',$env:_ -verb runas &exit)
+call :reg_takeownership "%regkey%" "SetValue, Delete" Deny S-1-5-32-544 S-1-5-18
 %$%
-:: lean xp+ color macros by AveYo:  %<%:af " hello "%>>%  &  %<%:cf " w\"or\"ld "%>%    for single \ / " use .%|%\  .%|%/  \"%|%\"
+
-for /f "delims=:" %%\ in ('echo/prompt $h$s$h:^|cmd/d') do set "|=%%\" &set ">>=\..\c nul &set/p \=%%\%%\%%\%%\%%\%%\%%\<nul&popd"
+echo Restore FullControl to Administrators and set owner to TrustedInstaller
-set "<=pushd "%allusersprofile%"&2>nul findstr /c:\ /a" &set ">=%>>%&echo;" &set "|=%|:~0,1%" &set/p \=\<nul>"%allusersprofile%\c"
+for /f "tokens=3" %%s in ('sc showsid TrustedInstaller') do set TI=%%s
 call :reg_takeownership "%regkey%" FullControl Allow S-1-5-32-544 %TI%
-:: Setup a test key
+%$%
-reg delete HKCU\TEMP\REG_OWN /f >nul 2>nul & reg add HKCU\TEMP\REG_OWN\DEL\ME /f >nul 2>nul
+
 echo Done!
-set VO=verbose-output :: now silent by default, only lists rights if VO is defined; to undefine: set "VO="
+timeout /t -1 &exit/b
 
-%<%:af " Allow FullControl from Administrators "%>>% & %<%:f0 " default, just this key "%>%
+:reg_takeownership  key:"HKCU\Console" perm:"FullControl" access:"Allow" user:"S-1-5-32-544" owner(optional):"S-1-5-18"
-echo call :reg_own "HKEY_CURRENT_USER\TEMP\REG_OWN"
+set "pargs=$regkey='%~1'; $p='%~2'; $a='%~3'; $u='%~4'; $o='%~5';"
-call :reg_own "HKEY_CURRENT_USER\TEMP\REG_OWN"
+powershell -noprofile -c "%pargs%; $f=[io.file]::ReadAllText('%~f0') -split ':ps_reg_own\:.*';iex ($f[1]);" & exit/b
 :ps_reg_own: [     pastebin.com/XTPt0JSC      AveYo: call :reg_takeownership "HKLM\MyKey" FullControl Allow S-1-5-18
-%<%:6f " Allow READ from Users "%>>% & %<%:f0 " recursive, disable inheritance "%>%
+$dll0='[DllImport("ntdll.dll")]public static extern IntPtr RtlAdjustPrivilege(int a,bool b,bool c,ref bool d);';
-echo call :reg_own "HKCU\TEMP\REG_OWN" all S-1-5-32-545 "" Allow "ReadPermissions, ReadKey"
+$nt=Add-Type -Member $dll0 -Name Nt -PassThru; foreach($i in @(9,17,18)){$null=$nt::RtlAdjustPrivilege($i,1,0,[ref]0)}
-call :reg_own "HKCU\TEMP\REG_OWN" all S-1-5-32-545 "" Allow "ReadPermissions, ReadKey"
+$root=$true; if($o -eq ''){$o=$u}; $rk=$regkey -split '\\',2; $key=$rk[1];
 switch -regex ($rk[0]){ '[mM]'{$HK='LocalMachine'};'[uU]'{$HK='CurrentUser'};default{$HK='ClassesRoot'}; }
-%<%:cf " Deny changes from %%USER%% and set owner to TrustedInstaller "%>>% & %<%:f0 " just this key "%>%
+$usr=0,0,0; $sec=0,0,0; $rule=0,0,0; $perm='FullControl',$p,$p; $access='Allow',$a,$a; $s=$o,$u,'S-1-5-32-544';
-echo call :reg_own "HKCU\TEMP\REG_OWN" "" %%USER%% %%TI%% Deny "SetValue,CreateSubkey,CreateLink,Delete,ChangePermissions,TakeOwnership"
+for($i=0;$i -le 2;$i++){ $usr[$i]=[System.Security.Principal.SecurityIdentifier]$s[$i];
-call :reg_own "HKCU\TEMP\REG_OWN" "" %USER% %TI% Deny "SetValue,CreateSubkey,CreateLink,Delete,ChangePermissions,TakeOwnership"
+ $rule[$i]=[System.Security.AccessControl.RegistryAccessRule]::new($usr[$i], $perm[$i], 3, 0, $access[$i]);
  $sec[$i]=[System.Security.AccessControl.RegistrySecurity]::new(); }
-%<%:5f " Allow FullControl from %%USER%% and set owner to SYSTEM "%>>% & %<%:f0 " all subkeys "%>%
+function Reg_TakeOwnership { param($hive, $key, $root=$false);
-echo call :reg_own "HKCU\TEMP\REG_OWN" all %%USER%% S-1-5-18 Allow FullControl
+ $reg=[Microsoft.Win32.Registry]::$hive.OpenSubKey($key,'ReadWriteSubTree','TakeOwnership'); $sec[2].SetOwner($usr[2]);
-call :reg_own "HKCU\TEMP\REG_OWN" all %USER% S-1-5-18 Allow FullControl
+ $reg.SetAccessControl($sec[2]); if($root){ $reg=$reg.OpenSubKey('','ReadWriteSubTree','ChangePermissions');
   $acl=$reg.GetAccessControl(); $acl.SetAccessRuleProtection($false,$false); $acl.ResetAccessRule($rule[1]);
-echo;
+  $reg.SetAccessControl($acl); } $sec[0].SetOwner($usr[0]); $reg.SetAccessControl($sec[0]); }
-%<%:0e " TO SIMPLY ADJUST VALUES THEN RESTORE PERMISSIONS I RECOMMEND THE FOLLOWING:"%>%
+Reg_TakeOwnership $HK $key $true; if($root){ $r=[Microsoft.Win32.Registry]::$HK.OpenSubKey($key);
  foreach($sk in $r.GetSubKeyNames()){try{ Reg_TakeOwnership $HK "$($key+'\\'+$sk)" $false}catch{} }}
-%<%:2f " Allow FullControl from Everyone "%>>% & %<%:f0 " recursive, preserve inheritance "%>%
+Get-Acl "$($rk[0]+':\\'+$rk[1])" | fl
-echo call :reg_own "HKEY_CURRENT_USER\TEMP\REG_OWN" preserve S-1-1-0
+:ps_reg_own: ]