Microsoft Docs

Security Functions and Structures

The Windows Registry stores configuration data and uses security descriptors to control access. This article describes the primary security‑related functions, structures, and best practices for managing registry permissions.

Key Security Functions

LONG RegGetKeySecurity(
    HKEY hKey,
    SECURITY_INFORMATION SecurityInformation,
    PSECURITY_DESCRIPTOR pSecurityDescriptor,
    LPDWORD lpcbSecurityDescriptor
);
LONG RegSetKeySecurity(
    HKEY hKey,
    SECURITY_INFORMATION SecurityInformation,
    PSECURITY_DESCRIPTOR pSecurityDescriptor
);
LONG RegGetValueW(
    HKEY hkey,
    LPCWSTR lpSubKey,
    LPCWSTR lpValue,
    RRF_RT_REG_NONE | RRF_RT_ANY,
    LPDWORD pdwType,
    PVOID pvData,
    LPDWORD pcbData
);

Security Descriptor Structure

typedef struct _SECURITY_DESCRIPTOR {
    BYTE  Revision;
    BYTE  Sbz1;
    SECURITY_DESCRIPTOR_CONTROL Control;
    PSID  Owner;
    PSID  Group;
    PACL  Sacl;
    PACL  Dacl;
} SECURITY_DESCRIPTOR, *PSECURITY_DESCRIPTOR;

Common Access Rights

Best Practices

• Always request the minimum required access rights.
• Validate and sanitize subkey and value names before using them.
• Use RegSetKeySecurity with PROTECTED_DACL_SECURITY_INFORMATION to prevent inheritance.
• When possible, use the KEY_READ and KEY_WRITE predefined sets instead of individual flags.
• Prefer RegOpenKeyEx with REG_OPTION_NON_VOLATILE for persistent keys.

Related Topics

• All Registry Functions
• Registry Structures
• Security Code Samples