next »

[worldphoenix]

I would like to take ownership of a registry key using Wisdom, before I run the apply registry permission task.....

(Reason is there are some reg keys in W2008 R2 where even the administrator doesn't have full rights)

Obviously this is a manual task on a server.

Wisdom doesn't have a task for this and I can't find any type of script that does this

Has anyone been able to do this at all e.g. using Wisdom to run a script?


Thanks

[mvrijn]

Do you really need to take ownership because Wisdom can change the rights for you so you will have access.

Look in the security section of commands.
Today i used it to gain access to a Citrix (IMA Xenapp 6)key which was not accessable.
Type "Administrators" in the User/Group section
Choose Full Control (or any other option you prefer)
Tick the replace on all subs.

It worked just fine and after i had full access to the key without taking ownership.

[RESguru]

I found a tool here, which I believe can do the requested operation: http://setacl.sourceforge.net/. It's a free utility.

From there it's easy to stick it into Automation Manager (wisdom) as a ressource and use the execute command with some well-placed module parameters.

If you create something nifty, don't forget to share!

[worldphoenix]

Thanks Max - thats a great tool...which works manually on the local machine

BUT.....


Automation Manager 2011 has some documented issues when executing commands remotely and this will not work remotely

This is the registy key (W2008 R2) I want to add local admins in as Full Control

HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

Using this SetACL exe it works fine manually

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -ot reg -actn ace -ace "n:Administrators;p:full"

However running this as a command task with AM 2011 with all the relevant options ticked, or as a batch file - it fails.

[Nathan Sperry]

I'm using the SetACL tool within Automation Manager to change the ownership of a registry key in HKCR. Can you try this command line.

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -ot reg -actn setowner -ownr "n:S-1-5-18;s:y"

The main difference between your command line and mine is the "setowner -ownr".

Nathan