Requested registry access is not allowed

7 Sep 2006 7:26 AM

UK1967

I wrote a ASP.NET application (Windows 2003 Enterprise Server, IIS, .NET
Framework 1.1). This application use the Windows (AD) account and
impersonation. Some functions in this application contact, read and change
the remote registry (HKLM/Software/...) of some internal server.

After installing SP1 on the web server (IIS) all functions with registry
access don't run and generate the following error: "Requested registry access
is not allowed."

Some ideas ?

11 Sep 2006 5:18 AM

UK1967

Here some additional informations to understand my problem a little bit better:

I have a web server (W2K3 without SP 1, IIS, .NET-Framework 1.1) with a
complex ASP.NET application. Hundreds of user using this service portal to
changing entries in the AD (on a second server) and regsitry keys (on a
third, fourth, ... server). I activated the impersonation and changes on AD
and remote registries works. After the installation of SP1 for W2K3 on my web
server the changes in AD work, but changes in remote registries didn't work.
I de-installed SP 1 and all functions works fine, after re-installation of SP
1 the registry acesses didn't work ("Requested registry access is not
allowed").

Now (only for testing) i set permission on the registries of the remote
servers (not on the web server) as follows:

\HKLM\Software -> Everyone (Full Control)
\HKLM\Software -> Domain Users (Full Control)

But i've got the same error message: "Requested registry access is not
allowed". I'm member of all local administrator groups of all used servers.
What's wrong ???

I don't like to use a embedded (secret) account, because i would like to use
the real logged user account. So i can check the real permissions of AD and
registries.

If i use the ASP.NET application without SP1 for Windows 2003 the registry
access is successful AND i can see a positiv entry in the "Serurity Event
Log" on the target server:

Event ID: 517
Success Audit (successful)

If i use the same application with SP1 for Windows 2003 the registry access
fails AND i can't see a matching entry in the "Security Event Log" on the
target server. In my opinion it's a indication that the web server blocks the
registry access and NOT the target server. I think, it's a significant
information.

Could somebody helps me ???

Thanks in advance.