Registry privileges?

[Doug Starkey]

I have recently upgraded a piece of software (ADP PCPayroll) and
everything went fine on all my workstations except my one Windows XP
Professional station.

I spent nearly an entire day on the phone with ADP trying to resolve the
issue and they finally concluded that, "the user does not have complete
access privileges to the registry".

I have three users set up on this desktop: Administrator (the default
that came with the original installation), myself (set up as a member ot
the "Administrators" group), and my payroll administrator (also set up
as a member of the "Administrators" group. Since all users are members
of the Administrators group, they should have complete and utter control
of the computer, right?

Well, based on ADP's conclusion, the two non-original users do not. For
whatever reason, my account & the payroll administrator's account cannot
"write" to the registry. If I log on as "Administrator" I have no
problems. I can access all functions of the ADP software.

I have similar set-ups on other machines (Administrator, myself, and a
primary user). Those machines are running Windows 2000. They have no
problems accessing the ADP software and utilizing all features.

I have tried setting up a new user from scratch, defining them as an
"Administrator" and I get the same result; when they access the ADP
software, an error message is generated that, according to ADP, means
that user does not have write-privileges to the registry.

I have completely uninstalled & re-installed the ADP software (with
ADP's assistance to insure that I was removing every hint of their
software). This did nothing.

I do not understand how I could NOT have write privileges to the
registry. Does anyone have a clue how this could happen? And, more
importantly, how to fix it?

 

[Carrie Garth]

| "Doug Starkey"
<http://www.microsoft.com/communities/privacy.mspx >
| Message
| I have recently upgraded a piece of software (ADP PCPayroll)
| and everything went fine on all my workstations except my one
| Windows XP Professional station.
|
| I spent nearly an entire day on the phone with ADP trying to
| resolve the issue and they finally concluded that, "the user
| does not have complete access privileges to the registry".
|
| <SNIP> Since all users are members of the Administrators group,
| they should have complete and utter control of the computer,
| right? Well, based on ADP's conclusion, the two non-original
| users do not. <SNIP>

Here is a quote from "Joe Richards [MVP]" about the built-in
Administrator account and some software coder practices:

Google Groups Link to the thread:
http://www.google.com/groups?&selm=uWna5nV4BHA.2816@tkmsftngp05

----- Begin QUOTE Original Message -----
From: Joe Richards [MVP]
Subject: Re: Admin permissions vs Admin group permissions
Newsgroups: microsoft.public.win2000.security
Date: 2002-04-11 06:19:43 PST

<SNIP> Some companies hard code their software to only
install with THE ADMINISTRATOR account (i.e. RID=500) because
they can guarantee that that ID will always exist so the profile
will always be there and info for uninstalls or reinstalls will
always be there. Also I have been told by some vendors they do it
because only the person who controls that account should really
be installing their software. If this is for company machines,
push back on the vendor for a better solution, if for a home PC
you are pretty much stuck with it.

--
Joe Richards

----- End QUOTE Original Message -----

Note: You may want to try using the Sysinternals tool Regmon
(which monitors and displays registry activity on a system in
real-time) to try and discover where access is being denied.
Then relax permissions. For more information about Regmon and
Filemon see the following Web Sites.

Sysinternals Freeware
Information for Windows NT and Windows 2000
http://www.sysinternals.com/ntw2k/utilities.shtml

Sysinternals Freeware
Utilities for Windows NT and Windows 2000 - Regmon
NOTE: Filtering Output, Jumping to a Key or Value in Regedit
http://www.sysinternals.com/ntw2k/source/regmon.shtml

 

[D.Currie]

I have recently upgraded a piece of software (ADP PCPayroll) and
everything went fine on all my workstations except my one Windows XP
Professional station.

I spent nearly an entire day on the phone with ADP trying to resolve the
issue and they finally concluded that, "the user does not have complete
access privileges to the registry".

I have three users set up on this desktop: Administrator (the default
that came with the original installation), myself (set up as a member ot
the "Administrators" group), and my payroll administrator (also set up
as a member of the "Administrators" group. Since all users are members
of the Administrators group, they should have complete and utter control
of the computer, right?

Well, based on ADP's conclusion, the two non-original users do not. For
whatever reason, my account & the payroll administrator's account cannot
"write" to the registry. If I log on as "Administrator" I have no
problems. I can access all functions of the ADP software.

I have similar set-ups on other machines (Administrator, myself, and a
primary user). Those machines are running Windows 2000. They have no
problems accessing the ADP software and utilizing all features.

I have tried setting up a new user from scratch, defining them as an
"Administrator" and I get the same result; when they access the ADP
software, an error message is generated that, according to ADP, means
that user does not have write-privileges to the registry.

I have completely uninstalled & re-installed the ADP software (with
ADP's assistance to insure that I was removing every hint of their
software). This did nothing.

I do not understand how I could NOT have write privileges to the
registry. Does anyone have a clue how this could happen? And, more
importantly, how to fix it?

I ran into something similar with, of all things, an HP printer. The
solution ended up being navigation through the registry to the keys involved
and changing the permissions for those keys. It's not much to go on, but
maybe you've got a similar situation.

 

[Kent W. England [MVP]]

Doug Starkey wrote on 27-Aug-2004 9:33 AM:

I have recently upgraded a piece of software (ADP PCPayroll) and
everything went fine on all my workstations except my one Windows XP
Professional station.

I spent nearly an entire day on the phone with ADP trying to resolve the
issue and they finally concluded that, "the user does not have complete
access privileges to the registry".
...

I do not understand how I could NOT have write privileges to the
registry. Does anyone have a clue how this could happen? And, more
importantly, how to fix it?

Just as with files, registry keys have permissions and you can be locked
out of a registry key without permission, even if you are an admin. Of
course, as an admin, you can change the key permissions to allow access,
but which key(s)? Only ADP knows.

You might be able to save yourself some time by trying to install the
software when logged on as each account that will use it. That trick
often works for game software, it might work in your case, otherwise,
you have to find the vendor keys (usually in HKLM\Software\vendor\app,
where "vendor" and "app" depend on your vendor and the application) and
then use the Permissions... menu item in regedit.exe to change the key
permissions. You likely can fix the problem by adding the Administrators
group with full permission, if you find that only the Administrator
account has write privilege.

 

[Doug Starkey]

| "Doug Starkey"
<http://www.microsoft.com/communities/privacy.mspx >
| Message
| I have recently upgraded a piece of software (ADP PCPayroll)
| and everything went fine on all my workstations except my one
| Windows XP Professional station.
|
| I spent nearly an entire day on the phone with ADP trying to
| resolve the issue and they finally concluded that, "the user
| does not have complete access privileges to the registry".
|
| <SNIP> Since all users are members of the Administrators group,
| they should have complete and utter control of the computer,
| right? Well, based on ADP's conclusion, the two non-original
| users do not. <SNIP>

Here is a quote from "Joe Richards [MVP]" about the built-in
Administrator account and some software coder practices:
[snip]

----- End QUOTE Original Message -----

Note: You may want to try using the Sysinternals tool Regmon
(which monitors and displays registry activity on a system in
real-time) to try and discover where access is being denied.
Then relax permissions. For more information about Regmon and
Filemon see the following Web Sites.

Sysinternals Freeware
Information for Windows NT and Windows 2000
http://www.sysinternals.com/ntw2k/utilities.shtml

Sysinternals Freeware
Utilities for Windows NT and Windows 2000 - Regmon
NOTE: Filtering Output, Jumping to a Key or Value in Regedit
http://www.sysinternals.com/ntw2k/source/regmon.shtml

Thanks for this tool recommendation. It was a big help. It has literally
been a matter of running the program, seeing where access was denied and
then fixing those permissions in the registry. It was time consuming,
but would have been impossible without Regmon.

Thanks for all your input, folks! It's been an education.

-Doug

 

[Carrie Garth]

|:| "Doug Starkey"
http://www.microsoft.com/communities/privacy.mspx
|:| |:| I have recently upgraded a piece of software (ADP PCPayroll)
|:| and everything went fine on all my workstations except my
|:| one Windows XP Professional station.
|:|
|:| I spent nearly an entire day on the phone with ADP trying to
|:| resolve the issue and they finally concluded that, "the user
|:| does not have complete access privileges to the registry"
|:| <SNIP>

:| :| Here is a quote from "Joe Richards [MVP]" <SNIP> Some
:| companies hard code their software to only install with THE
:| ADMINISTRATOR account (i.e. RID=500) <SNIP> End
:| QUOTE Original Message <SNIP>
:| try using the Sysinternals tool Regmon <SNIP>

| "Doug Starkey"
http://www.microsoft.com/communities/privacy.mspx
| | Thanks for this tool recommendation. It was a big help. It has
| literally been a matter of running the program, seeing where
| access was denied and then fixing those permissions in the
| registry. It was time consuming, but would have been impossible
| without Regmon.
|
| Thanks for all your input, folks! It's been an education.

YW. And yes... I, too, have found the Sysinternals tools
Regmon and Filemon "a big help" when working with applications
that do not meet the 3.3 and 3.4 baseline requirements for the
"Designed for Windows XP" logo for software, as described at the
Microsoft Windows Logo Program Qualification Service Web site and
partially quoted below:

3.0 Data and Settings Management

Applications that are designed to work with the Windows XP
infrastructure for state separation of data will work correctly
under Limited User accounts and allow multiple users to share a
single computer with separate preferences and settings.

3.3 Deal gracefully with access-denied scenarios
3.4 Support running as a Limited User

And I, too, oftentimes find the process "time consuming".

Note to Self. Take a break during "time consuming" activities.
Pop in the inspirational DVD Disk 2 of _Jonah - A VeggieTales
Movie (2002)_. The one with the Music Videos. Sing and dance
along with Peter Furler (Wow! Bald is soooo S_ _ _ ... uh
Beautiful!). And when we get to the line ..."How long is this
gonna take?" sing it loud and smile :- )

Note to all. Keep in mind that you can use the Microsoft Windows
Catalog to search for, and review, the compatibility status of
software to determine whether or not the product works with
Windows XP.

Works Cited:

"In the Belly Of The Whale" performed by Peter Furler and the
Newsboys. _Jonah - A VeggieTales Movie (2002)_. Dir. Mike
Nawrocki, Phil Vischer. DVD. Studio: Lionsgate/Fox, DVD
Release Date: March 4, 2003.

"Microsoft Windows Catalog". _Microsoft Windows Catalog Home
Page_. Microsoft Corporation.
Last updated: Friday, July 9, 2004 - 7:59 AM.
http://www.microsoft.com/windows/catalog/default.aspx

"Software Requirements Overview". _Software Requirements
Overview - Windows Logo Program_. Microsoft Corporation.
Last Updated: April 4, 2002.
http://www.microsoft.com/winlogo/software/swoverview.mspx

 

[Doug Starkey]

Note to Self. Take a break during "time consuming" activities.
Pop in the inspirational DVD Disk 2 of _Jonah - A VeggieTales
Movie (2002)_. The one with the Music Videos. Sing and dance
along with Peter Furler (Wow! Bald is soooo S_ _ _ ... uh
Beautiful!). And when we get to the line ..."How long is this
gonna take?" sing it loud and smile :- )

Note to all. Keep in mind that you can use the Microsoft Windows
Catalog to search for, and review, the compatibility status of
software to determine whether or not the product works with
Windows XP.

Works Cited:

"In the Belly Of The Whale" performed by Peter Furler and the
Newsboys. _Jonah - A VeggieTales Movie (2002)_. Dir. Mike
Nawrocki, Phil Vischer. DVD. Studio: Lionsgate/Fox, DVD
Release Date: March 4, 2003.

HAHAHA! Love that movie! Heck, just flat love Bob & Larry! (Although,
I'm more fond of "The Pirates Who Don't Do Anything"... reminds me of a
certain software company....)

(oops, now I'm gonna get censored, aren't I?)