Run REGEDIT As SYSTEM User To Circumvent Windows Registry Access Denied Errors

Successfully Tested On: Windows 7 Enterprise SP1, Windows 8 Enterprise, Windows 8.1 Enterprise, Windows 10 Enterprise versions 1507 - 20H2, Windows 10 Long-Term Servicing Branch (LTSB) versions 1507 & 1607, Windows 10 Long-Term Servicing Channel (LTSC) versions 2015 - 2019

Occasionally the Windows Registry may throw “Access Denied” errors to Administrators when using the Registry Editor. This can happen when editing or even just viewing certain keys.

One example of this is when trying to view a key whose permissions have become corrupt or one that is owned by the SYSTEM user with no permissions applied. When trying to interact with or manipulate these keys, an Access Is Denied error will show:

When trying to edit permissions on these problematic keys, Windows may say you do not have permission to view the current permission settings, but you can make permission changes:

Despite this message, an Access Denied error may display when attempting to make permission changes.

PsTools and PsExec

Microsoft provides a handy utility called PsExec which is included in a larger set of utilities called PsTools. PsExec lets us execute processes in a variety of ways. The function that will be useful to us is one that lets us run a program (RegEdit.exe) as the SYSTEM account.

First, download PsTools.zip from Microsoft’s SysInternals here: https://download.sysinternals.com/files/PSTools.zip

Next, unzip and extract the downloaded folder. You will see a variety of tools in the extracted PsTools folder.

Lastly, open a Command Prompt (run as Administrator), change directories to the extracted PsTools folder, and use the PsExec file with necessary parameters to call RegEdit.exe:

psexec -i -s c:\windows\regedit.exe

The Windows Registry Editor will now launch interactively and be running as the built-in SYSTEM account. The SYSTEM account will generally be able to manipulate all Registry keys without errors.

The -i parameter means we’re using interactive mode. The -s parameter is the real heavy lifter here as it runs the process as the SYSTEM account.

Using PsExec to launch Registry Editor has proven to be a useful method when dealing with Registry keys who are denying administrators access.

More information about PsExec can be found on Microsoft’s website here: https://docs.microsoft.com/en-us/sysinternals/downloads/psexec