China DOS Union

Hello everyone, while testing registry permissions in a batch file, I found that when calling SETLOCAL to modify registry permissions,
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /registry /grant everyone /read /p:no_dont_copy can prevent creating files under RUN, but likewise:
@setacl CLASSES_ROOT\exefile\shell\open\command /registry /grant
everyone /read /p:no_dont_copy has no effect,

I've already searched the forum for relevant materials and couldn't find anything. I hope some kind person can help me with how to set permissions on key values.

I'm waiting online

Typed it wrong?
CLASSES_ROOT should be HKEY_CLASSES_ROOT, right...
Haven't tested it, so I don't know whether it will work after entering it correctly

No typo, there's also this before it: @rem HKLM

So depressing, looks like the experts all can't be bothered to answer this question /. I've waited a long time, really disappointed. Let me be more specific. Here's the code. My question is, why does the first part work, but the second and third parts don't? Hope an expert can point it out:

:Selection
@rem User Choice
@echo.
@echo Please enter the number before the option below
@echo.
@echo 1: Install protection
@echo 2: Restore default settings
@echo.
@set /p UserSelection=Enter your choice (1,2,3,4)
@if "%UserSelection%"=="1" goto install
@if "%UserSelection%"=="2" goto uninstall
@if "%UserSelection%"=="3" goto information
@if "%UserSelection%"=="4" goto quit
@rem Any other input
@cls
@goto Selection

:information
@pause>nul 2>nul
@cls
@goto Selection
:install
@set OP=/grant everyone /read /p:no_dont_copy
@goto Doit
:uninstall
@set OP=/revoke everyone /read /p:yes
@goto Doit

:Doit
@echo.
@echo Operation in progress...
@rem HKLM (first part)
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /registry %OP%>nul 2>nul
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /registry %OP%>nul 2>nul
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices /registry %OP%>nul 2>nul
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEX /registry %OP%>nul 2>nul
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEX /registry %OP%>nul 2>nul
@setacl machine\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesEx /registry %OP%>nul 2>nul

@rem HKCU (second part)
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEX /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEX /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesEx /registry %OP%>nul 2>nul
@setacl CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce /registry %OP%>nul 2>nul

@rem USERS (third part)
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEX /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEX /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesEx /registry %OP%>nul 2>nul
@setacl USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce /registry %OP%>nul 2>nul

[ Last edited by xmiou on 2007-3-30 at 10:54 PM ]

:@rem HKLM is only for comments.

I don't have setacl here, you'd better check carefully how its paths are supposed to be written.

I have this setacl too. You only need to put it in the same directory. I just don't understand why the first part works, while the other parts don't.

Did you notice machine? It's a problem with how setacl is used

Then why can machine be used, but CURRENT_USER and USER can't? What should they be changed to? Thanks for the tip