The correct registry keys for app settings and passowrds

Hi,
In the past (before Vista) I've been using SaveSettings()/GetSettings() to handle app settings which. Those two functions write/read HKEY_CURRENT_USER key.

I would also save encrypted passwords to a HKEY_LOCAL_MACHINE\bla\bla\bla key


I hear KKEY_LOCA_MACHINE isn't gonna work if user has no admin privilages on Vista.

I don't wan't to store the passwords in HKEY_CURRENT_USER\Software\VB & VBA Program Settings\.....

What's the preffered place/key to save passwords/app settings to, so that I don't run into trouble when user doesn't have admin privilages on Vista?

The correct place for any user to write to (and stored separately per user) is: HKEY_CURRENT_USER\Software\AppOrCompanyName

For an admin user to write/anyone to read (shared by all users), you can use the HKEY_LOCAL_MACHINE equivalent.


Note that it has been that way has been that way since Windows 2000, which (like XP) also has the same issues as Vista when you are logged in as a limited user (as many people do).


An alternative is to use a file, but again you need to think about location - using the per-user or common AppData folders (Program Files is very bad, and even worse on Vista).

OK.
But for things like "days left to the end of Trial" data I wanted to avoid using
HKEY_CURRENT_USER\Software\AppOrCompanyName and have a location that would be more difficult to find, to guard the data from people who want to mess with it or delete it (which would reset the Trial mode to another 30 days).

That's a tough one, and there is no "right" answer to it.

Storing it in a per-user place (like HKEY_CURRENT_USER, or the users AppData folder) is not ideal, as it means they can simply create a new Windows login to make the trial start over again (they don't even need to log in to it, just start your program with "run as").

To store it elsewhere you need them to be an admin, which is why most people make setting it up part of their installation process.

As to where you should store it, there isn't much difference to be honest.. you could use the registry (HKEY_LOCAL_MACHINE) or a file (common AppData). Either way (or even if you pick somewhere else, which is not advisable), people will be able to find it if they want to, as there are tools to monitor which files & registry settings are modified when a program/installation runs.

No matter where you store it, it should be encrypted so that it can't be read/modified easily. If you do set it up during installation, you can also be sure that it should exist, so if it doesn't then simply act as if the trial has expired.

Encryption like Si mentions is the only real way to protect your trial app. If you place the file on a users location on Vista it will be locally readable to only that user and public locations needadmin perms to write to. but if they are installing your app they should have admins perms anyways.

If the file is deleted then you can add a message that the installation is invalid or such and have them rerun the installation package. In your installation process have it do a validation of the passowrd or serial number.