Windows Registry Key “Access is Denied” Error

The Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform. The Registry Editor is a tool that allows you to view and modify the Windows Registry.

However, some users may encounter the “Access is denied” error when they try to delete or modify a registry key or change the permission of a registry key when they do not have the required permission to do so. In this article, we’ll explore the reasons behind this error and how to overcome the issue in Windows 11 or Windows 10.

The errors that you may see when you do not have the permission for a registry key

When you do not have the permission to access or modify a registry key, you may see the following errors:

• “Error Opening Key – [registry key] cannot be opened. An error is preventing this key from being opened. Details: Access is denied.” – This error can occur when your user account doesn’t have the required permissions to access a registry key.
• “Windows Security – You do not have permission to view the current permission settings for [registry key], but you can make permission changes.” – You may encounter this error message when you’re unable to view the current permission settings for a registry key due to a lack of permission.
• “Unable to save permission changes on [registry key]. Access is denied” – If you don’t have the necessary permission to change the permission or set a new owner for a registry key, you may encounter this error.

Reason behind “Access is denied” error

The “Access is Denied” error can occur due to various reasons, including:

• Insufficient permissions: If the user account does not have the necessary permissions to access or modify the registry key, the error can occur. For instance, some registry keys are owned by the SYSTEM account, and some are owned by TrustedInstaller. These are high-level permissions that are above the Administrator account, and even the Administrator account cannot change the permission or take ownership of these keys.
• Ownership issues: In some cases, the registry key may be owned by a different user or group, which can prevent other users from accessing or modifying it.
• Malware infections: Malware infections can cause registry keys to become protected, preventing users from accessing or modifying them. In such cases, additional steps are required to reset the registry ACL permissions before removing the key.

How to overcome “Access is denied” error in Registry Editor

Try taking ownership of the registry key

If you encounter the “Access is denied” error when modifying or deleting a registry key or changing its permission in Registry Editor, the first solution you should try is to take ownership of the Registry key. However, if you are still unable to change the permission of a registry key even as an administrator, you should move on to the second solution.

1. Search for “Registry Editor” or “Regedit” via Start menu and open it.
2. Navigate to the Registry key that you want to modify.
3. Right-click the key and select “Permissions“.
4. Next, click the “Advanced” button.
5. In the “Advanced Security Settings” dialog, if it says “Unable to display current owner,” or if your account isn’t the current owner, click “Change“.
6. In the “Enter the object name to select” field, type your user name and click “OK“.
7. Your user account will now show up as the owner. Check the “Replace owner on subcontainers and objects” checkbox if you also want to take ownership of the subkeys under the selected registry key.
8. Click Apply to save the changes.

Now that you have taken the ownership of this registry key, you can assign permissions to specific user or branch in order to modify or delete the registry key. Here’s how.

1. In the same “Advanced Security Settings” window (if you’ve closed the window, simply reopen it following the same steps in the previous instruction), click Add.
2. In the Permission Entry window, click “Select a principal“.
3. Enter the user account name you want to modify the permission for, then click OK.
4. Under Basic permissions, select Full Control and Read.
5. Click OK to save the changes.
6. When you are back to the Advanced Security Settings window, click OK again to save the changes.

You can repeat the steps if you want to add and grant permissions to other users such as Administrator, etc.

If you are unable to take ownership or change the permission for a registry key

If you are unable to take ownership or change the permission for a registry key in the Registry Editor and receive the error message “unable to save permission changes,” it may be because the registry key is currently owned by the SYSTEM or TrustedInstaller. In such cases, even the Administrator account will not be able to modify the registry key or change its permission. To resolve this issue, you need to run the Registry Editor as SYSTEM or TrustedInstaller.

Using PsExec.exe from Windows Sysinternals

PsExec.exe is a command-line utility from the Windows Sysinternals suite, which is now owned by Microsoft. PsExec allows you to run commands and programs on remote computers, as well as execute them in the context of another account, such as the SYSTEM account. This is useful for situations where you need to perform administrative tasks that require elevated privileges or modify system files that are otherwise protected, such as editing a registry key owned by the SYSTEM user.

Follow these instructions to run the Registry Editor as SYSTEM using PsExec.exe from Windows Sysinternals.

1. Download PsExec.exe from the Windows Sysinternals website.
2. Extract the PsExec.exe file to a folder on your computer.
3. Open Command Prompt with administrative privileges.
4. Change directory in CMD to where you extracted the PsExec.exe file.
5. Next, type the following command and press Enter:

   psexec.exe -sid c:\windows\regedit.exe

   

6. This will launch Registry Editor as SYSTEM. You can now modify the Registry key.

You can skip step 4 by directly inputting the full path to the psexec.exe file, for example:

c:\downloads\psexec.exe -sid c:\windows\regedit.exe

Using Advanced Run from Nirsoft

Advanced Run is a free utility from Nirsoft that allows you to run programs with different settings than the default settings. With Advanced Run, you can specify the user account, working directory, and other advanced settings for a program, including running it as SYSTEM or TrustedInstaller. This is useful when you need to perform administrative tasks that require elevated privileges or run programs with non-default settings.

In the case of the “Access is denied” error in Registry Editor, running Advanced Run with the “Run As” option set to SYSTEM or TrustedInstaller allows you to launch Registry Editor with the necessary permissions to modify the Registry key that is causing the error.

To use Advanced Run to run the Registry Editor as SYSTEM or TrustedInstaller, follow these steps:

1. Download Advanced Run from the Nirsoft website.
2. Extract the AdvancedRun.exe file to a folder on your computer.
3. Run Advanced Run with administrative privileges.
4. Click on the “Browse” button and select the Registry Editor executable file (regedit.exe) or manually type the path: “C:\Windows\regedit.exe“.
5. Under the “Run As” section, select “SYSTEM User” or “TrustedInstaller account“.
6. Click “OK” to launch Registry Editor as SYSTEM or TrustedInstaller.

After running Registry Editor as SYSTEM or TrustedInstaller, try to repeat the previous method to take ownership of a Registry key again.

Final thoughts

In this article, we explored the reasons behind the “Access is denied” error when modifying or deleting registry keys and how to overcome it. The Registry Editor is a powerful tool for Windows users, but it requires the appropriate permissions to work correctly. By following the steps outlined in this article, you can take ownership of registry keys and modify their permissions to suit your needs.