[VERY URGENT] Change Registry Settings in Win7

hi, i am using vb6. I made a program. And it need to change the specific registry value. Please see the attached module for registry events.

It works on winXP, but whenever i tried to win7 a error message said "Access Denied"

Here is the code :
SetStringValue "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell", Chr(34) & "SampleText" & Chr(34)

Please some one help me out asap...
my project is 99.95% done, and i am stuck at this step.

So, i request you guys please help me out ASAP.

best regards
kamrul hassan

To edit entires in HKEY_LOCAL_MACHINE your app has to have admin rights, it has to be elevated (Run As Admin). You can only edit HKCU hive with standard user level.

So your problem will be manifested on W7 and Vista, where UAC is turned on. This is because on these systems, even Administrator type accounts actually run as standard users, and prompt for elevation of privileges when needed/requested.

You can manifest your application to always run as admin, but that is not advised, as it's usually a workaround for improper coding. There are also drawbacks. For security reasons, for example, applications that always run as admin, cannot run on windows start (Start up folder in start menu, or HKCU|HKLM\Software\Microsoft\Windows\CurrentVersion\Run)

hi, baja_yu, thank you so much, for your response, but it looks complicated to me, would you please make it a little bit simple. i mean the source code to run my app as admin. .or exactly what should i have to do to bypass this error.

Please reply asap

best regards
kamrul hassan

Unfortunatelly, it's a complicated subject. I'll try to explain it in short.

Since Windows Vista came out, it implemented a security feature called User Account Control (UAC for short). This mean that by default everything in Windows runs at a standard user level, even if the user account is of administrator type. This is comparable to Windows XP and Limited user accounts.

Standard user (rights) level means that an application can not do everything it wants on the system. For example, it can't write to the registry except to the HKEY_CURRENT_USER hive (which you discovered), it also cant write to the hard disk in protected locations like the root of the partition (C:\), Windows, Program Files, System32 folders etc.

Applications that need to do some (protected) operations like those I just described, give a prompt and ask for rights elevation. You would have noticed this every time you installed an applicaiton in Vista or W7, that prompt popping up first where you have to click Continue. What happens at that step, is Windows gives that specific application/process Admin rights. Installers for example need this because they have to set various registry settings and/or write to Program Files folder (to copy its files).

How to get your application to elevate its privileges to Admin level?

The quickest and dirtiest way around the "problem" would be to turn off UAC. (in Control Panel > Users) but I DO NOT recommed you do this or relly on it, especially if you distribute your application to other users.

The other solution is to make a manifest for your applicaton. It is a .manifest file that accompanies your exe, which basically tells Windows that it should always run your application at Admin level. But this will result in the prompt I mentioned before, popping up every time you run your application and needing a confirmation from the user. There are many ways and examples on how to do this (which you can find by Searching the forum for terms like "manifest application", "create manifest" etc), but there are problems too. What I mentioned before, if your application has a "Start with Windows" option, so it automatically starts when Windows does, this will no longer work, because Windows security features don't allow applications with admin rights to start automatically.
Another drawback with applications running with elevated privileges, is that you have no way of downgrading those privileges when calling (shelling) other processes, and consider this an immensely stupid "feature" (lets call it that). This means, that if your application running as admin, opens any other application (notepad, IE etc), that application too will automatically inherit Admin rights and run elevated too. User level process have ways of 'asking' for elevation (RunAs keyword in ShellExecute for example), but there is none other way around. There are other problem areas but I wont go into details now.

Third option is to split your application into a service-applicaiton combo. This means that you will create one Service (which has almost all rights as an application running elevated to Admin) that will hold 'the business' code (editing registry, writing, deleting files etc), and one GUI frontend application that will run at standard user level, and whenever it needs to do something it will tell the service to do it (they can communicate via files, named pipes etc). By doing this your application can run smooth, even boot with Windows, and you wont have any nagging UAC prompts. This is described in more detail in this MSDN article: http://msdn.microsoft.com/en-us/libr...rinter%29.aspx
Now, the downsides to this. I consider it the best solution, but it requires SERIOUS rewrites and restructuring of your application. And I mean SERIOUS, unless your application is very small or trivial. One more security feature that adds complication to this solution is that Services now (since Vista) run in an isolated Session 0. This means that they can not have aboslutely any interaction with the Desktop, no windows, no prompts, no messages, it can't shell other applications or processes. So some of the business logic will have to be transfered to the service and some will have to stay with the front end applicaiton. This also means that the Service can't give any visible feedback in regards to the applcations it performs. If an error occured in a procedure it was doing, and you need to tell the user that, the Service will have to tell that back to the application, and have it show the error message. One more problem when it comes to writting to registry is that the service can't access the HKCU hive. This means that for this part too, the application will have to do it, your code will be doubled, and you will have to check the hive first. If it is HKCU do it directly from the application, if it is some other hive, tell the service to do it.

There are many more aspects to this, but I think I've sufficiently scared you for now. ;)

hi, baja_yu, thank you so much again, for your response, but it looks more complicated than earlier and also yes bro.. you really scared me.. :))
so, though you, don't suggest for option 1, but i have to try it..
please try to give me better solution if you have :)

best regards
kamrul hassan

I'd still advise you against it. Except if only you or a couple of friends will be using the application, maybe I can look the other way then :).
But telling a user to turn UAC off is like telling them to uninstall their Anti Virus or Firewall. It disables their security systems.

Here is some info on creating manifest files from MSDN: http://msdn.microsoft.com/en-us/library/bb756929.aspx and an excellent thread and sample project by LaVolpe here: http://www.vbforums.com/showthread.php?t=606736