I am trying to run a (PoSh) script as SYSTEM (i.e. at startup, via SCCM or otherwise) that needs to read some protected registry keys, and it can't see them.
A normal user doesn't have permission to see the keys. (Using a Mozilla key as an example, but there can be dozens under the "Tree" node.)
PS C:\> whoami
contoso\testuser
PS C:\> $KeyPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla"
PS C:\> $Key = Get-Item $KeyPath
Get-Item : Requested registry access is not allowed.
An admin user can see (but not change) the keys:
PS C:\> whoami
LocalComputer\administrator
PS C:\> $KeyPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla"
PS C:\> Get-Item $KeyPath
Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree
Name Property
Mozilla SD : {1, 0, 4, 140...}
But the SYSTEM account just doesn't see anything:
PS C:\> whoami
nt authority\system
PS C:\> $KeyPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla"
PS C:\> Get-Item $KeyPath
Get-Item : Cannot find path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla'
because it does not exist.
SYSTEM has full control over the registry key and the parent key. What Admin sees (with permissions).
This is what SYSTEM sees in the Registry.
How can SYSTEM not see it? How can I read this key via startup script (or other SYSTEM activity)?
Thanks.
Edit: As far as I can tell, this is is the case on ALL Win10 1809+, and not just a single machine.
Get-PSProvider Registry. If that exists, test(Get-PSProvider Registry).Drives... – Keith Miller Apr 20 '21 at 23:25HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\tree. At that point, the only child item is the "Microsoft" key even though the Admin account sees about 15 child items (including "Mozilla"). – Teknowledgist Apr 21 '21 at 13:59UserChoiceor an extension fromHKCU\...\Explorer\FileExtsis an example. And that's as the user with Admin credentials. – Keith Miller Apr 22 '21 at 13:00PinandUnPinverbs. – Keith Miller Apr 22 '21 at 13:04SYSTEMand if another method of doing that would get a better result. – Vomit IT - Chunky Mess Style Apr 23 '21 at 19:49