Windows 10: Powershell command to change application advance security settings in registry.

In order to collect application data in the security audit logs for EventViewer the application permissions in the registry need to be adjusted. I have done this manually and have it working with Azure Sentinel. I need to deploy this across the entire range of assigned devices for all users. I have even tried to export the reg settings for the specific application but the permission set for it is not there. Below is a example of what I am trying to change.HKEY_USERS\SID#\SOFTWARE\ApplicationNameIn the application advance settings "Advance Security Settings" in the Auditing tab, apply full acce

:)

 

Windows PowerShell instead of Command Window

This issue in the Context Menu usually occurs if changes were made in the registry. May we know if you made any changes in the value of the registry of your device?

Based from the result of the SFC tool, there are some corrupted files found in the system. We suggest that you continue with the troubleshooting steps using the
Deployment Image Servicing and Management (DISM) tool. Follow the steps:

• Press Windows key + X.
• Click on Command Prompt (Admin).
• Type the command, DISM.exe /Online /Cleanup-image /Restorehealth and hit
  Enter.

Let us know if the steps provided above works for you.

 

Locked Powershell startup command in context menu

This solved my not being able to disable the 2 powershell scripts but why are they there in the first place?

 

Locked Powershell startup command in context menu

It seems that you cannot remove the folder because you don't have a permission to do so. To remove the two
powershell.exe -noexit -command Set-Location '%V' on registry, we need first to set the permission to
Everyone. To do so, kindly follow the steps below:

• Open CC Cleaner
• Go to Context Menu
• Right-click on powershell.exe -noexit -command Set-Location '%V'.
• Click on Open in RegEdit.
  
  
• Right-click on the Powershell folder.
• Click Permission
• Click Advanced
• Click Change
• Type in "Everyone" without the quotation.
• Click OK

Also set the Administrator's permission to Full Control. After doing so, you can now delete the
Powershell folder. Be guided that you need to do a backup of your
Registry before doing the steps.

Let us know how it goes.