File permissions on HKCR\Typelib

My apologies as this is only indirectly related to package development, but it's close enough that I'm sure someone can provide some input.

I'm dealing with a problem on numerous machines where IE can't spawn new windows. Regmon reveals Access Denied failures when Users read a few of the HKCR\Typelib keys, while local admins have no problems. It's a user security level issue only. Looks like a bunch of the keys denying user reads are Office XP components, maybe some apps as well.

So, I think I pinpointed my problem but I can't figure out how machines ended up in this condition. Office XP wasn't repackaged. Any thoughts as to how or why HKCR\Typelib security became set to Admin access only???

0 Comments   [ + ] Show comments

Answers (5)

Posted by: ictu packager 15 years ago
Orange Belt
the typelib component always has problems with adobe packages such as illustrator
just a guess but im not sure if something like adobe reader may set the permission on this?
Posted by: MSIMaker 15 years ago
2nd Degree Black Belt
This sounds like it might be an MS Hotfix permission change or something along those lines. Most vendor apps don't change permissions on workstations.

What permissions are actually on the keys?
Posted by: VikingLoki 15 years ago
Second Degree Brown Belt
For one of the two dozen or so keys SetACL reported:
BUILTIN\Administrators,full,allow,no_inheritance:NT AUTHORITY\SYSTEM,full,allow,no_inheritance

Adding BUILTIN\Users:Read to all the keys fixes the issue with the web app, but the HotFix thing was a concern of mine. Am I unraveling anything important with that fix? Ugh.
Posted by: aogilmor 15 years ago
9th Degree Black Belt
I've seen apps that do a "set value" or "create key" (from regmon) on HKLM and HKCR. Typically those are the ones you have to open up to Users.

I've not seen any apps that deny access to users or restrict reg permissions, though I could see somethign like that happening in a (buggy) hotfix or SP.

Good luck,
Posted by: plangton 15 years ago
Second Degree Blue Belt
Hi VikingLoki,

I had this same problem about 2 years ago (with IE5 mind you) and the regmon/filemon traces led me nowhere. It turned out to be I needed to register c:\windows\system32\SHLWAPI.DLL. I don't know if that will help you or not but I hope it does :)


Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ