Main Scripting Challenges Delivering massive registry changes involves the following challenges: Security context under which the script runs. Security is the most important among all scripting challenges. | Main Scripting Challenges Delivering massive registry changes involves the following challenges Security context under which the script runs. Security is the most important among all scripting challenges. As you recall starting with Windows 2000 the security model has undergone some changes one of which is the introduction of the new built-in Power Users security group. The Users group has limited privileges. Thus when running a script that delivers changes to a part of the system registry to which a normal user account doesn t have sufficient privileges you must consider the security context under which that change can be successfully introduced. For example many keys under HKEY_LOCAL_MACHINE have default permissions which restrict non-administrative user accounts from modifying them. Only Administrators and Power Users can change these keys and consequently perform such tasks as installing services and applications for all users of the system . One possible answer to this problem would be to reduce normal security to ease the registry change distribution but this is highly undesirable. A much better approach would be to use the right tools at the right time. The timing problem. To illustrate this problem consider the following situation. Suppose that you need to make changes to a specific user profile HKEY_CURRENT_USER . To achieve this goal successfully either that user must be logged on or at least the hive of that user s profile must be loaded into a temporary registry key. Now consider a more complicated situation you need to modify both HKLM and HKCU and do it simultaneously. Thus your script will have to operate with two different security contexts at the same time not to mention ensuring that the target user is currently logged on. Logging of changes. Logging and possibly reporting of registry changes is a must especially in large corporate networks which need a centralized way to report the result of the changes. Unfortunately tools such as Regeditexe are
