Skip to main content

How to Set Registry Permissions in a Batch Script

Controlling access to the Windows Registry is a critical security and configuration management task. You might need to grant a specific user or application the right to write to a configuration key, or conversely, lock down a sensitive key to prevent unauthorized changes. While the REG command can manage keys and values, it cannot alter permissions. For this, you must use a lesser-known but powerful, built-in utility: regini.exe.

This guide will teach you how to set registry permissions using the regini command. You will learn its unique script-file-based syntax, how to interpret the permission codes, and how to create a batch script that can dynamically generate and execute a regini script to apply these permissions.

danger

CRITICAL WARNING: Modifying registry permissions is a very high-risk operation. Incorrectly removing permissions from a critical system key can render your system unstable or unbootable. Always have a full backup before you begin. This script must be run with full administrator privileges.

The Core Command: regini.exe​

The regini.exe (Registry Initializer) utility is a command-line tool designed to modify registry permissions by executing a script file. Unlike REG.EXE, you do not pass the permissions as command-line arguments. Instead, you must first create a text file that defines the keys and the permissions you want to apply.

Syntax: regini "Path\To\ScriptFile.ini"

The regini Script File Syntax​

A regini script is a simple text file with a specific format.

Registry\Key\Path [PermissionCodes]
  • Registry\Key\Path: The full path to the registry key, using the standard HKEY_... format.
  • [PermissionCodes]: A space-separated list of numbers in brackets that represent the Access Control List (ACL). Each number grants a specific permission to a specific group.

Understanding the Permission Codes​

The permission codes are the most complex part of using regini. They are numbers that correspond to predefined user groups and their allowed access levels.

Common User/Group Codes:

  • 1: Administrators
  • 2: Administrators
  • 6: SYSTEM
  • 8: INTERACTIVE users (the user currently logged on at the console)
  • 11: Authenticated Users
  • 17: BUILTIN\Users

Common Permission Codes:

  • 1: Full Control
  • 2: Read
  • 3: Read & Write
  • 4: Read, Write, & Delete
  • 6: Read & Execute
  • 8: Read, Write, & Execute

A full list is available in Microsoft's documentation. The format for an entry is [GroupCode PermissionCode]. For example, [1 1] grants Administrators Full Control.

The Scripting Method: A Two-File Approach​

To automate this, your batch script will dynamically create the regini script file and then execute it.

  1. Use ECHO commands to write the key path and permission codes to a temporary text file.
  2. Execute regini and point it at the temporary file.
  3. Delete the temporary file.

Basic Example: Granting Full Control to a User​

Let's grant the "Users" group full control over a specific application's settings key.

Example:

@ECHO OFF
REM This script MUST be run as an Administrator.

SET "RegKey=HKEY_LOCAL_MACHINE\SOFTWARE\MyCoolApp"
SET "ReginiScript=%TEMP%\setperms.ini"

ECHO --- Setting Registry Permissions ---
ECHO Key: %RegKey%
ECHO Granting BUILTIN\Users Full Control.
ECHO.
PAUSE
ECHO.

REM --- Step 1: Create the regini script file ---
REM [1 1] = Admins Full Control (good practice to reaffirm)
REM [17 1] = BUILTIN\Users Full Control
ECHO %RegKey% [1 1 17 1] > "%ReginiScript%"

ECHO --- Step 2: Execute regini ---
regini "%ReginiScript%"

REM --- Step 3: Cleanup ---
DEL "%ReginiScript%"

ECHO --- Permissions applied. ---

Common Pitfalls and How to Solve Them​

  • Administrator Rights: This is the number one cause of failure. You will receive an "Access is denied" error if your script is not run from an elevated command prompt. Solution: You must run the script as an Administrator.

  • Complex Syntax: The numeric codes are not intuitive. It's very easy to use the wrong code and assign the wrong permissions.

    • Solution: Keep a link to the official Microsoft documentation for regini handy and double-check your codes before running the script. The alternative is to use a more user-friendly tool like PowerShell's Set-Acl cmdlet.

  • regini Overwrites, It Doesn't Add: The permissions you list in the brackets completely replace the existing permissions on the key. You are not "adding" a permission; you are defining the entire new ACL. This is why it's good practice to always include [1 1] to ensure administrators don't get locked out.

Practical Example: A "Lock Down" Security Script​

This script is designed to tighten security on a sensitive registry key. It removes permissions for standard users and ensures only Administrators and the SYSTEM account have full control.

@ECHO OFF
SETLOCAL
REM This script MUST be run as an Administrator.

SET "SensitiveKey=HKEY_LOCAL_MACHINE\SOFTWARE\MyCompany\SecretSettings"
SET "ReginiScript=%TEMP%\lockdown.ini"

ECHO --- Locking Down Registry Key ---
ECHO This will restrict access to Administrators and SYSTEM only.
ECHO Target: %SensitiveKey%
ECHO.
PAUSE
ECHO.

REM --- Create the regini script ---
REM [1 1] = Administrators Full Control
REM [6 1] = SYSTEM Full Control
ECHO %SensitiveKey% [1 1 6 1] > "%ReginiScript%"

ECHO Applying new permissions...
regini "%ReginiScript%"

DEL "%ReginiScript%"

ECHO.
ECHO [SUCCESS] The key has been secured.

ENDLOCAL

Conclusion​

The regini.exe utility is the powerful, if somewhat cryptic, built-in tool for managing registry permissions from a batch script.

For successful and safe use:

  1. Always run your script as an Administrator.
  2. Back up the registry key (REG EXPORT) before you make any permission changes.
  3. Use the two-file method: have your batch script ECHO the key path and permission codes into a temporary script file.
  4. Execute the script with regini "scriptfile.ini".
  5. Remember that regini replaces all existing permissions, so be sure to include all the permissions you want the key to have.

While more modern tools like PowerShell offer a more readable syntax (Set-Acl), regini is a powerful and universally available tool for any administrator needing to script registry security.

Table of Contents