运行 regsvr32 /s /c “myocx.ocx” 需要哪些权限/权限？

发布于 2024-07-13 21:05:52 字数 259 浏览 11 评论 0原文

我有一台 WindowsXP 配置为构建机器。构建过程在非管理员帐户下运行。

有些项目将 ocx 控件注册为最后一步，类似于

regsvr32 /s /c ".\debug\myocx.ocx"

此步骤失败，我认为这与权限有关，因为在管理员帐户下执行相同的操作可以正常工作。

我需要为构建帐户提供哪些权利/权限/策略以及在哪里进行操作？（浏览本地用户和组以及本地安全设置对我没有帮助）

原文

I have a WindowsXP configured as a build machine. The build process runs under an account which isn't an administrator.

Some projects register as a last step an ocx control with something like

regsvr32 /s /c ".\debug\myocx.ocx"

This step fails and I assume that this has something to do with rights because doing the same under an admin account works fine.

What rights/permissions/policies do I need to give the build account and where do I do it? (Browsing Local Users and Groups and Local Security Settings haven't helped me)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

电影里的梦 2024-07-20 21:05:52

通过 regedit，您需要授予“HKEY_CLASSES_ROOT”上的构建帐户权限。

右键单击 HKEY_CLASSES_ROOT 并选择“权限...完全控制”。

回复收藏 0 原文

枫以 2024-07-20 21:05:52

回复收藏 0 原文

倚栏听风 2024-07-20 21:05:52

PowerShell 脚本无需成为管理员即可应用 regsvr32 权限

虽然可以授予 HKCR 密钥的完全控制权，但这可能导致授予超出必要的访问权限。在研究如何做到这一点时，我最终在 HKCR 上获得了权限，导致需要重新映像我的计算机。为了编写这个脚本，我使用了 procmon 工具，并过滤拒绝的注册表权限，然后在脚本中授予它们。

以下 PowerShell 脚本仅对我确定注册 DLL（以及 OCX）所需的那些密钥创建（非继承）权限。这允许单个帐户（在本例中为构建服务器代码生成器帐户）被授予注册 DLL 的访问权限，而无需成为管理员。将第一个变量 - $buildAcctUserName - 替换为设置规则时要使用的帐户。

$buildAcctUserName = "AzureDevOpsBuilder"

# Create Rule for full control of keys that need to be added to/updated/deleted from
$user = New-Object System.Security.Principal.NTAccount("$($env:COMPUTERNAME)\$buildAcctUserName")
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
  $user, 
  [System.Security.AccessControl.RegistryRights]"FullControl", 
  [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit",  <# ContainerInherit / None / ObjectInherit #>
  [System.Security.AccessControl.PropagationFlags]::None, 
  [System.Security.AccessControl.AccessControlType]::Allow)

# Grant access to HKCR
$regHKCRHive=[Microsoft.Win32.RegistryHive]::ClassesRoot;
$regHKCRBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKCRHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKCRBaseKey.OpenSubKey("", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKLM\Software
$regHKLMHive=[Microsoft.Win32.RegistryHive]::LocalMachine
$regHKLMBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKLMHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKLM\Software\Wow6432Node
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE\Wow6432Node", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Wow6432Node\CLSID
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\CLSID", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\TypeLib
$regkey=$regHKCRBaseKey.OpenSubKey("TypeLib", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Wow6432Node\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\Interface", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Interface", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\AppID
$regkey=$regHKCRBaseKey.OpenSubKey("AppID", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

PowerShell Script to apply permissions for regsvr32 without being an Admin

Whilst it's possible to just grant full control of the HKCR key, that might result in granting more access than necessary. While researching how to do this, at one point I ended up hosing the permissions on HKCR, resulting in the need to reimage my machine. In order to come up with this script, I used the procmon tool, and filtered for registry permissions denied, then granted them in the script.

The following PowerShell script creates (non-inherited) permissions on just those keys that I've determined necessary for registration of DLLs (and thus OCXs). This allows a single account (in this case, a build server code builder account) to be granted access to register DLLs without being an administrator. Replace the first variable - $buildAcctUserName - with the account to use when setting rules.

$buildAcctUserName = "AzureDevOpsBuilder"

# Create Rule for full control of keys that need to be added to/updated/deleted from
$user = New-Object System.Security.Principal.NTAccount("$($env:COMPUTERNAME)\$buildAcctUserName")
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
  $user, 
  [System.Security.AccessControl.RegistryRights]"FullControl", 
  [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit",  <# ContainerInherit / None / ObjectInherit #>
  [System.Security.AccessControl.PropagationFlags]::None, 
  [System.Security.AccessControl.AccessControlType]::Allow)

# Grant access to HKCR
$regHKCRHive=[Microsoft.Win32.RegistryHive]::ClassesRoot;
$regHKCRBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKCRHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKCRBaseKey.OpenSubKey("", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKLM\Software
$regHKLMHive=[Microsoft.Win32.RegistryHive]::LocalMachine
$regHKLMBaseKey=[Microsoft.Win32.RegistryKey]::OpenBaseKey($regHKLMHive,[Microsoft.Win32.RegistryView]::Default)
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKLM\Software\Wow6432Node
$regkey=$regHKLMBaseKey.OpenSubKey("SOFTWARE\Wow6432Node", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Wow6432Node\CLSID
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\CLSID", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\TypeLib
$regkey=$regHKCRBaseKey.OpenSubKey("TypeLib", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Wow6432Node\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Wow6432Node\Interface", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\Interface
$regkey=$regHKCRBaseKey.OpenSubKey("Interface", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

# Grant access to HKCR\AppID
$regkey=$regHKCRBaseKey.OpenSubKey("AppID", $true) 
$acl = $regkey.GetAccessControl()
$acl.SetAccessRule($rule)
$regkey.SetAccessControl($acl)

回复收藏 0 原文