Defense in depth — the Microsoft way (part 89): user group policies don’t deserve tamper protection  – Full Disclosure

Posted by Stefan Kanthak on Jun 03

Hi @ll,

user group policies are stored in DACL-protected registry keys
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPolicies]
respectively [HKEY_CURRENT_USERSoftwarePolicies] and below, where
only the SYSTEM account and members of the “Administrators” user group
are granted write access.

At logon the user’s registry hive “%USERPROFILE%ntuser.dat” is loaded
with exclusive (read, write and…
 – Read More  – Full Disclosure