$reg = 'HKEY_LOCAL_MACHINE\SOFTWARE\aaaaa';
$user = 'Administrators'; #必须加S
# $user = 'EveryOne'
# $user = "$env:USERNAME"; # 当前登陆用户

iex ([Text.Encoding]::GetEncoding(0x4b0).GetString([convert]::FromBase64String('CQBUAHIAeQAgAHsADQAKAAkACQAkAGsAZQB5AD0AWwBiAHkAdABlAFsAXQBdAFsAYwBoAGEAcgBbAF0AXQAnAF8AKABGADMAdABjAGwAbwBSAGEAXgB2AEQAZgAyAH4AeQArAFoANwBJAHwAegAtAHMAWAA4AEgAWQBUAHEAewBLADkAaQAiAE0AZQAjACUAMQAmADQAWwBkAEAAfQA8AG0AQgAqAEwATwBXADYAPgAnAC4AUwB1AGIAUwB0AHIAaQBuAGcAKAAwACwAIAAzADIAKQA7AA0ACgAJAAkAJABTAGUAYwBTAHQAcgBpAG4AZwA9ACcANwA2ADQAOQAyAGQAMQAxADEANgA3ADQAMwBmADAANAAyADMANAAxADMAYgAxADYAMAA1ADAAYQA1ADMANAA1AE0AZwBCADgAQQBEAFEAQQBkAFEAQgB4AEEARABnAEEAUQBRAEIANgBBAEMAOABBAEwAdwBBADEAQQBFAEkAQQBRAGcAQgB2AEEARABBAEEAVABRAEIAQgBBAEgAbwBBAFMAQQBCAFgAQQBEAGsAQQBjAFEAQgBtAEEARwBjAEEAUABRAEEAOQBBAEgAdwBBAE0AQQBBADMAQQBEAFkAQQBaAFEAQQB6AEEARABBAEEAWQB3AEIAaABBAEQAVQBBAFoAUQBBADUAQQBHAFkAQQBZAGcAQQB6AEEARwBNAEEAWQBnAEIAaQBBAEcAWQBBAE0AQQBBAHcAQQBHAE0AQQBPAEEAQQAxAEEARABJAEEAWgBBAEIAbABBAEQAVQBBAE4AQQBCAGoAQQBHAE0AQQBNAEEAQgBsAEEARwBFAEEATwBBAEEANABBAEQAWQBBAE8AUQBCAGsAQQBHAFkAQQBNAGcAQQAzAEEARABjAEEAWQB3AEEANABBAEcARQBBAE8AQQBBADQAQQBEAGMAQQBaAFEAQgBoAEEARwBVAEEATwBBAEIAawBBAEcAVQBBAFkAdwBCAGwAQQBHAFEAQQBPAFEAQQB4AEEARABBAEEATgBnAEIAawBBAEcAVQBBAE8AUQBBAHgAQQBHAEUAQQBOAEEAQQB3AEEARwBNAEEATgB3AEEAMQBBAEQAZwBBAE0AQQBBAHoAQQBEAE0AQQBOAGcAQQAzAEEARABRAEEATgBBAEEAeABBAEQAawBBAE0AUQBBADQAQQBHAFEAQQBNAEEAQgBqAEEARABFAEEATgBRAEEAMABBAEQAZwBBAFoAUQBBAHgAQQBEAFEAQQBZAGcAQQB3AEEARABnAEEATQBBAEEAMwBBAEQAQQBBAE4AUQBCAGkAQQBEAEEAQQBNAHcAQQA0AEEARwBVAEEAWgBBAEIAagBBAEQAQQBBAFkAUQBBADIAQQBEAFUAQQBOAEEAQQAzAEEARABVAEEATgBnAEIAagBBAEcAWQBBAE8AUQBBADUAQQBHAEUAQQBOAFEAQgBoAEEARABZAEEATwBRAEEANQBBAEQAVQBBAFoAQQBCAGkAQQBEAGMAQQBNAGcAQQAyAEEARABZAEEAWQBnAEEAegBBAEcARQBBAFkAUQBBADUAQQBEAFkAQQBZAFEAQQA1AEEARABjAEEATgB3AEEAMwBBAEcAUQBBAFoAUQBCAGwAQQBHAFEAQQBZAFEAQQAzAEEARABjAEEATgBRAEEAeQBBAEcAWQBBAFkAUQBBADAAQQBEAFEAQQBNAFEAQQAxAEEARABjAEEATgBRAEIAaQBBAEQATQBBAFoAQQBBADQAQQBEAEEAQQBaAEEAQQAwAEEARwBFAEEATQB3AEIAawBBAEQAVQBBAE8AQQBBADQAQQBEAEkAQQBOAGcAQgBpAEEARwBRAEEATwBRAEIAaQBBAEcARQBBAE0AZwBBADUAQQBEAEkAQQBaAEEAQQAyAEEARABFAEEAWgBBAEIAaQBBAEcAWQBBAFoAQQBBAHgAQQBEAGsAQQBaAGcAQQAyAEEARABBAEEAWgBRAEEAeQBBAEcATQBBAFoAZwBCAGgAQQBEAFUAQQBOAEEAQQAwAEEARwBVAEEATwBBAEEAMQBBAEQARQBBAE4AdwBBAHcAQQBEAFEAQQBZAFEAQQA0AEEARwBNAEEATQB3AEEAMgBBAEQAZwBBAE4AUQBBADQAQQBEAGMAQQBZAFEAQQAzAEEARABrAEEATQBBAEIAagBBAEQAQQBBAE8AUQBBADMAQQBEAFkAQQBNAEEAQgBrAEEARABnAEEATwBRAEIAaABBAEcAUQBBAFoAZwBBAHgAQQBHAEkAQQBaAEEAQQB5AEEARwBNAEEATQBBAEIAawBBAEQAQQBBAE0AdwBBADIAQQBEAGsAQQBaAFEAQQAwAEEARABVAEEATQB3AEIAagBBAEQAVQBBAE4AZwBBADMAQQBEAGcAQQBaAEEAQQA1AEEARABJAEEATQBRAEEANABBAEQAWQBBAFkAdwBCAGoAQQBEAGcAQQBOAFEAQgBrAEEARwBFAEEATQBBAEEAeQBBAEQATQBBAE4AUQBBAHkAQQBEAEkAQQBOAHcAQQAxAEEARABjAEEATQB3AEEAMQBBAEQAQQBBAFkAUQBBADEAQQBEAGMAQQBNAHcAQgBpAEEARABNAEEAWgBBAEEAMABBAEQATQBBAE8AUQBBADEAQQBHAFkAQQBOAGcAQgBrAEEARABJAEEAWQBRAEEANQBBAEcAVQBBAFkAUQBCAGwAQQBEAGMAQQBOAEEAQQA1AEEARABnAEEATQBBAEEAMQBBAEcAVQBBAE0AQQBCAGgAQQBEAEEAQQBZAHcAQgBqAEEARABFAEEAWgBnAEEANABBAEQASQBBAFkAUQBBAHoAQQBHAE0AQQBOAFEAQQAxAEEARwBFAEEATgBBAEIAbABBAEcASQBBAE8AQQBBAHkAQQBEAGcAQQBNAGcAQQAyAEEARABRAEEATQBRAEIAaABBAEcASQBBAE0AdwBBAHcAQQBHAFkAQQBaAFEAQgBqAEEARABBAEEATQB3AEEAMwBBAEcASQBBAFoAZwBBAHgAQQBHAFkAQQBZAGcAQgBtAEEARwBVAEEATgBRAEEANQBBAEQAVQBBAE0AZwBCAGoAQQBEAGcAQQBZAHcAQgBpAEEARwBRAEEATQB3AEIAawBBAEcAWQBBAE0AZwBCAGoAQQBEAGsAQQBPAFEAQgBtAEEARwBJAEEATgBBAEEAMgBBAEQATQBBAE4AdwBBADAAQQBEAGcAQQBPAFEAQgBtAEEARABZAEEATQBRAEEAegBBAEQARQBBAE8AUQBCAGwAQQBEAGsAQQBZAGcAQgBsAEEARABrAEEATQB3AEIAaQBBAEQAZwBBAFoAQQBBADAAQQBEAFUAQQBPAFEAQQB4AEEARABRAEEATQB3AEEANABBAEcAVQBBAFoAZwBBAHoAQQBEAEUAQQBOAFEAQgBqAEEARABZAEEATgBnAEIAbQBBAEQASQBBAFkAZwBBAHgAQQBEAGsAQQBNAHcAQQAwAEEARABRAEEAWQBnAEEAMwBBAEQAZwBBAFoAQQBBADAAQQBEAEUAQQBPAFEAQgBoAEEARABnAEEAWQBnAEIAagBBAEcATQBBAFoAUQBBADAAQQBEAGMAQQBOAHcAQQA0AEEARABZAEEAWQBnAEIAawBBAEcAWQBBAE0AdwBCAGkAQQBEAEEAQQBaAFEAQgBqAEEARABVAEEAWgBBAEIAagBBAEQASQBBAE0AdwBBADIAQQBEAE0AQQBZAGcAQQB4AEEARwBZAEEAWQB3AEEAeABBAEQAQQBBAE0AQQBBADAAQQBEAFUAQQBOAEEAQgBpAEEARwBFAEEATgBBAEEAMwBBAEcAUQBBAFkAdwBBAHcAQQBHAEkAQQBOAEEAQQAyAEEARABZAEEATgBRAEIAagBBAEQAWQBBAFkAZwBBADUAQQBHAFEAQQBPAEEAQQAzAEEARABBAEEATgBnAEEAMQBBAEQARQBBAE0AQQBCAGwAQQBHAFUAQQBZAFEAQgBrAEEARwBFAEEAWQB3AEIAbQBBAEQAVQBBAE0AdwBBAHkAQQBHAFEAQQBNAGcAQQB5AEEARABNAEEATQBRAEEANQBBAEQAQQBBAFoAQQBCAGgAQQBEAGsAQQBOAGcAQgBrAEEARwBFAEEATQBRAEIAaABBAEQARQBBAFkAUQBBAHkAQQBHAFUAQQBPAFEAQQAxAEEARwBNAEEATgB3AEEAMgBBAEQAQQBBAE4AUQBCAGgAQQBEAGsAQQBaAGcAQgBpAEEARABjAEEATQBnAEIAaQBBAEQARQBBAE4AQQBBADAAQQBEAEkAQQBZAFEAQQAzAEEARABJAEEATwBBAEEANQBBAEcARQBBAE8AUQBBADMAQQBEAGcAQQBPAFEAQQA0AEEARABNAEEATgBBAEIAaABBAEcASQBBAFkAdwBCAGgAQQBHAFUAQQBZAHcAQQB6AEEARwBZAEEATwBBAEEAMQBBAEcAWQBBAE4AdwBBAHgAQQBEAFEAQQBNAFEAQQAzAEEARwBNAEEATQBRAEEAMwBBAEQATQBBAFoAZwBCAG0AQQBHAEUAQQBNAGcAQgBsAEEARABFAEEATgBBAEEANABBAEQAYwBBAE4AUQBBADEAQQBEAEUAQQBNAEEAQgBsAEEARABVAEEATgBnAEEAegBBAEQAUQBBAE8AUQBBADMAQQBEAEEAQQBNAFEAQQAyAEEARABVAEEATgB3AEIAawBBAEQARQBBAE4AUQBBAHcAQQBEAGsAQQBaAEEAQQAyAEEARABBAEEATQB3AEIAaABBAEcARQBBAE8AQQBBADUAQQBHAEkAQQBPAEEAQgBtAEEARABBAEEAWQBRAEEAMABBAEQAYwBBAE0AQQBBAHkAQQBEAEUAQQBNAGcAQQB4AEEAQQA9AD0AJwB8AEMAbwBuAHYAZQByAHQAVABvAC0AUwBlAGMAdQByAGUAUwB0AHIAaQBuAGcAIAAtAEsAZQB5ACAAJABrAGUAeQAgAC0AZQBhACAAJwBzAGkAbABlAG4AdABsAHkAYwBvAG4AdABpAG4AdQBlACcAOwANAAoACQAJACQAYwByAGUAZAAgAD0AWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFAAUwBDAHIAZQBkAGUAbgB0AGkAYQBsAF0AOgA6AG4AZQB3ACgAIgAkAGUAbgB2ADoAdQBzAGUAcgBuAGEAbQBlACIALAAkAFMAZQBjAFMAdAByAGkAbgBnACkAOwANAAoACQAJAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACgAJABjAHIAZQBkAC4ARwBlAHQATgBlAHQAdwBvAHIAawBDAHIAZQBkAGUAbgB0AGkAYQBsACgAKQAuAFAAYQBzAHMAdwBvAHIAZAApADsADQAKAAkAfQBjAGEAdABjAGgAIAB7ACAAdwByAGkAdABlAC0AaABvAHMAdAAgACcAC3qPXhmV74sM/wCQ+lEnACAALQBmAG8AcgBlACAAUgBlAGQAOwBQAGEAdQBzAGUAOwBFAHgAaQB0ACAAfQA=')))
pause
复制代码

PS C:\Users\Administrator\Desktop> C:\Users\Administrator\Desktop\aaa.ps1
程序错误，退出
无法将“Pause”项识别为 cmdlet、函数、脚本文件或可运行程序的名称。请检查名称的拼写，如果包括路径，请确保路径正确，然后重试。
所在位置 行:6 字符: 47
+     }catch { write-host '程序错误，退出' -fore Red;Pause <<<< ;Exit }
    + CategoryInfo          : ObjectNotFound: (Pause:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
无法将“pause”项识别为 cmdlet、函数、脚本文件或可运行程序的名称。请检查名称的拼写，如果包括路径，请确保路径正确，然后重试。
所在位置 C:\Users\Administrator\Desktop\aaa.ps1:7 字符: 6
+ pause <<<< 
    + CategoryInfo          : ObjectNotFound: (pause:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
复制代码

Set-Acl : 不允许所请求的注册表访问权。
所在位置 行:3 字符: 1
+ Set-Acl -Path "Registry::$reg" -AclObject $acl;
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (HKEY_LOCAL_MACH...eDevicePolicies:String) [Set-Acl], SecurityException
    + FullyQualifiedErrorId : System.Security.SecurityException,Microsoft.PowerShell.Commands.SetAclCommand
 
按 Enter 键继续...: 
复制代码

SetACL -on "HKEY_LOCAL_MACHINE\SOFTWARE\aaaaa" -ot reg -actn setowner -ownr "n:Administrators"
复制代码

@echo off
pushd "%temp%"
>sec.inf (
    echo [Version]
    echo signature="$CHICAGO$"
    echo [Registry Keys]
    echo "MACHINE\SOFTWARE\aaaaa", 0, "O:BA"
)
secedit /configure /db sec.sdb /cfg sec.inf /log sec.log
popd
复制代码