Windows 10: How do I restrict access to REGEDIT to regular User?

This is the way I have the settings right now.. they look to me as if it should be asking for admin credentials when a regular user tries to open regedit.. am I right, or do I need to change anything here?

 

Don't feel like experimenting on my machine but wouldn't limiting Admin rights prevent registry changes? In other words, a user who doesn't have admin rights shouldn't be able to edit the registry.

Or are you trying to limit those who have admin rights?

 

Not at all..what I am saying is that regular user accounts that do NOT have admin rights have access and are able to edit regedit.exe.

What I am trying to do is force regular users to be prompted to enter the ADMIN password in order to open regedit.exe...I am NOT trying to disable it completely from regular users.

I have never seen this before in any other Windows OS.. regular user accounts have never been able to open regedit.exe without first entering the admin password.

 

My reply in red.

 

what I mean by regular users are ALL users that are NOT administrator accounts.
If you create a new user on your PC (non admin), you will see that you can type "regedit" in the search bar and you will be able to open regedit.exe without any UAC prompt at all.. it will go straight in.

 

Well I expect this anyway since I've got admin rights. But I get your point. Anyway I've go no suggestions at this moment. Was just curious.

Let us know what you find.

Peace *Cool

 

That would block the software (in additional rules etc) from running. full stop. As you have blocked all users including Admin. why would it bring up an admin prompt for software admin can't run? you would need to exclude admins. and retry.

As for "standard users" running configuration software as per Microsoft : Standard accounts can run most software and are allowed to change system and account settings.

you are ideally looking for a "limited user account" (domain/enterprise features) or a "Child account" (as linked child accounts can be very limited as to what they can execute)

 

Standard users don't have full access to regedit.

They can change things in the current user (i.e. their user) hive but not other hives (local machine etc) as they aren't authorized.

 

Yes, the changes would (should) only apply to the local account but I'm guessing the OP doesn't want those changed as well.

 

To prevent unauthorized persons from running certain programs, just change the name of the program.
I've used that many times in the past, even on my Commodore 64. *Smile

Cheers Mates!
*Cool

PS: To change a file's name, you will probably have to "Take Ownership" of that file.
The program "Grant Admin Full Control" will do that for you. It's FREE!

 

So nobody knows why Windows 10 is allowing for a regular user account to have access to the registry?
I mean, this was not the case in previous Windows OS..access to the registry has always been Admin access ONLY.

 

According to this article "Running commands like Regedit as a standard user"
Running commands like Regedit as a standard user
it states "I can view and change values under "Current User", but only can view values under "Local Machine" (cannot change)."
--- Although it's for Windows 7, test it out on your Windows 10.
--- Look for values in hives other than Local Machine and see if that statement is true.
--- Determine whether or not viewing and changing values are only possible under Current User.
BTW, Ix07 & sygnus21 have mentioned those items (maybe also others on previous pages but I don't know how to go back to double-check while posting this information).
--- So hopefully a standard user really is has limited capabilities
--- If you do evaluate what that article points out, please let us know what you find out.

EDIT: I just created a local account and the statement "it states "I can view and change values under "Current User", but only can view values under "Local Machine" (cannot change)." appears to be true. I really didn't want to make changes since I don't know what I would want to experiment with on what to change.
--- However, the ability to change values under "Current User" makes sense
--- Delving into Local Machine brought "xxx cannot be opened" which amounts to being unable to make changes.
Checking the remaining hives, it appears to be able to modify some of the folder contents but I wasn't about to play with any of them.
--- If you find something in the remaining hives to modify an entry your way: please let us know how it goes.

 

Correct, nobody knows why it's doing that... because it doesn't. I promise you, your normal users do not have full access to regedit. They can only edit the HKEY_CURRENT_USER hive. They cannot edit HKEY_LOCAL_MACHINE hive.