设为首页收藏本站
切换到宽版

 找回密码
 注册
搜索
批处理之家»论坛 › 批处理专区: BAT CMD DOS › BAT求助&讨论 › 如何禁止修改注册表的某个项
[新手上路]批处理新手入门导读[视频教程]批处理基础视频教程[视频教程]VBS基础视频教程[批处理精品]批处理版照片整理器
[批处理精品]纯批处理备份&还原驱动[批处理精品]CMD命令50条不能说的秘密[在线下载]第三方命令行工具[在线帮助]VBScript / JScript 在线参考
返回列表 发新帖
查看: 118|回复: 6

[注册表类] 如何禁止修改注册表的某个项

[复制链接]
hzusb
发表于 9 小时前 | 显示全部楼层 |阅读模式
已知“HKCR\.xxx”项为空，且无任何子项，我想锁定它，让任何程序都不能写入。用regset.ini修改后没用，如图。
未标题-1.jpg
回复

举报

jiavip
发表于 7 小时前 | 显示全部楼层
脚本和工具很难实现的,手动把权限和审核全部去除才可以。。。。。
回复

举报

aloha20200628
发表于 6 小时前 | 显示全部楼层
实现禁止的操作均有对应的 '逆操作' 化解，只是操作难度的差别。
要看你防御哪个层次的人了，对擅长此道的老手，化解都不是事，尤其如今的 ai 可谓如虎添翼...
回复

举报

hzusb
 楼主| 发表于 6 小时前 | 显示全部楼层
aloha20200628 发表于 2026-8-17 11:47
实现禁止的操作均有对应的 '逆操作' 化解，只是操作难度的差别。
要看你防御哪个层次的人了，对擅长此道的 ...

不考虑逆操作，不能写入就行
回复

举报

ShowCode
发表于 5 小时前 | 显示全部楼层
你使用“管理员”权限修建了马奇诺防线。
程序也能拿到“管理员”权限（甚至更高权限），它当然能把你修的马奇诺防线给拆掉啦：）
回复

举报

77七
发表于 5 小时前 | 显示全部楼层
AI：
RegClassLock.bat
  1. @echo off
  2. setlocal EnableExtensions

  4. :: Auto elevate
  5. fltmc >nul 2>&1
  6. if errorlevel 1 (
  7.     powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
  8.     exit /b
  9. )

  11. cls
  12. echo ==========================================
  13. echo        HKCR Extension Lock Tool
  14. echo ==========================================
  15. echo.

  17. set /p "EXT=Input extension, for example .xxx: "

  19. if "%EXT%"=="" exit /b

  21. :: Automatically add "." if omitted
  22. if not "%EXT:~0,1%"=="." set "EXT=.%EXT%"

  24. echo.
  25. echo Target:
  26. echo     HKCR\%EXT%
  27. echo.
  28. echo [1] Lock
  29. echo [2] Unlock
  30. echo [0] Exit
  31. echo.

  33. choice /c 120 /n /m "Select: "

  35. if errorlevel 3 exit /b
  36. if errorlevel 2 goto unlock
  37. if errorlevel 1 goto lock


  40. :lock
  41. cls
  42. echo Locking HKCR\%EXT% ...
  43. echo.

  45. :: HKCR is merged from these two locations
  46. reg add "HKCU\Software\Classes\%EXT%" /f >nul 2>&1
  47. reg add "HKLM\Software\Classes\%EXT%" /f >nul 2>&1

  49. powershell -NoProfile -Command "$ErrorActionPreference='Stop';try{$deny=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::SetValue -bor [int][System.Security.AccessControl.RegistryRights]::CreateSubKey -bor [int][System.Security.AccessControl.RegistryRights]::Delete);$open=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::ReadPermissions -bor [int][System.Security.AccessControl.RegistryRights]::ChangePermissions);$sid=New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0');$rule=New-Object System.Security.AccessControl.RegistryAccessRule($sid,$deny,[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Deny);foreach($base in @([Microsoft.Win32.Registry]::CurrentUser,[Microsoft.Win32.Registry]::LocalMachine)){$k=$base.OpenSubKey('Software\Classes\%EXT%',[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$open);$acl=$k.GetAccessControl();$acl.RemoveAccessRuleSpecific($rule)|Out-Null;$acl.AddAccessRule($rule);$k.SetAccessControl($acl);$k.Close()};exit 0}catch{Write-Host $_;exit 1}"

  51. if errorlevel 1 (
  52.     echo.
  53.     echo [ERROR] Lock failed.
  54. ) else (
  55.     echo.
  56.     echo [OK] HKCR\%EXT% is locked.
  57.     echo.
  58.     echo Blocked:
  59.     echo   - Set or modify values
  60.     echo   - Create subkeys
  61.     echo   - Delete the key
  62. )

  64. echo.
  65. pause
  66. exit /b


  69. :unlock
  70. cls
  71. echo Unlocking HKCR\%EXT% ...
  72. echo.

  74. powershell -NoProfile -Command "$ErrorActionPreference='Stop';try{$deny=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::SetValue -bor [int][System.Security.AccessControl.RegistryRights]::CreateSubKey -bor [int][System.Security.AccessControl.RegistryRights]::Delete);$open=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::ReadPermissions -bor [int][System.Security.AccessControl.RegistryRights]::ChangePermissions);$sid=New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0');$rule=New-Object System.Security.AccessControl.RegistryAccessRule($sid,$deny,[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Deny);foreach($base in @([Microsoft.Win32.Registry]::CurrentUser,[Microsoft.Win32.Registry]::LocalMachine)){$k=$base.OpenSubKey('Software\Classes\%EXT%',[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$open);if($k){$acl=$k.GetAccessControl();$acl.RemoveAccessRuleSpecific($rule)|Out-Null;$k.SetAccessControl($acl);$k.Close()}};exit 0}catch{Write-Host $_;exit 1}"

  76. if errorlevel 1 (
  77.     echo.
  78.     echo [ERROR] Unlock failed.
  79. ) else (
  80.     echo.
  81.     echo [OK] HKCR\%EXT% is unlocked.
  82. )

  84. echo.
  85. pause
  86. exit /b
复制代码


初步测试通过。
回复

举报

77七
发表于 5 小时前 | 显示全部楼层

测试用的脚本，一并附上，右键管理员执行

AI：

  1. @echo off
  2. setlocal
  3. set "EXT=.zzacltest95250"

  5. net session >nul 2>&1
  6. if errorlevel 1 (
  7.     echo [ERROR] 请右键以管理员身份运行
  8.     pause
  9.     exit /b
  10. )

  12. echo === 创建测试项 ===
  13. reg delete "HKCU\Software\Classes\%EXT%" /f >nul 2>&1
  14. reg delete "HKLM\Software\Classes\%EXT%" /f >nul 2>&1
  15. reg add "HKCU\Software\Classes\%EXT%" /f >nul
  16. reg add "HKLM\Software\Classes\%EXT%" /f >nul

  18. echo.
  19. echo === 加锁 ===

  21. powershell -NoProfile -Command "$ErrorActionPreference='Stop';$deny=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::SetValue -bor [int][System.Security.AccessControl.RegistryRights]::CreateSubKey -bor [int][System.Security.AccessControl.RegistryRights]::Delete);$open=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::ReadPermissions -bor [int][System.Security.AccessControl.RegistryRights]::ChangePermissions);$sid=New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0');$rule=New-Object System.Security.AccessControl.RegistryAccessRule($sid,$deny,[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Deny);foreach($base in @([Microsoft.Win32.Registry]::CurrentUser,[Microsoft.Win32.Registry]::LocalMachine)){$k=$base.OpenSubKey('Software\Classes\%EXT%',[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$open);$acl=$k.GetAccessControl();$acl.AddAccessRule($rule);$k.SetAccessControl($acl);$k.Close()};exit 0"

  23. if errorlevel 1 (
  24.     echo [ERROR] 加锁失败
  25.     goto cleanup
  26. )

  28. echo [OK] 加锁成功

  30. echo.
  31. echo === 测试 ===

  33. reg add "HKCR\%EXT%" /v test /d 123 /f >nul 2>&1
  34. if errorlevel 1 (echo [PASS] HKCR 写值被阻止) else (echo [FAIL] HKCR 写值成功)

  36. reg add "HKCR\%EXT%\abc" /f >nul 2>&1
  37. if errorlevel 1 (echo [PASS] HKCR 创建子项被阻止) else (echo [FAIL] HKCR 创建子项成功)

  39. reg add "HKCU\Software\Classes\%EXT%" /v test /d 123 /f >nul 2>&1
  40. if errorlevel 1 (echo [PASS] HKCU 写值被阻止) else (echo [FAIL] HKCU 写值成功)

  42. reg add "HKLM\Software\Classes\%EXT%" /v test /d 123 /f >nul 2>&1
  43. if errorlevel 1 (echo [PASS] HKLM 写值被阻止) else (echo [FAIL] HKLM 写值成功)

  45. reg delete "HKCU\Software\Classes\%EXT%" /f >nul 2>&1
  46. if errorlevel 1 (echo [PASS] HKCU 删除被阻止) else (echo [FAIL] HKCU 删除成功)

  48. reg delete "HKLM\Software\Classes\%EXT%" /f >nul 2>&1
  49. if errorlevel 1 (echo [PASS] HKLM 删除被阻止) else (echo [FAIL] HKLM 删除成功)

  51. :cleanup
  52. echo.
  53. echo === 恢复 ===

  55. powershell -NoProfile -Command "$ErrorActionPreference='SilentlyContinue';$deny=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::SetValue -bor [int][System.Security.AccessControl.RegistryRights]::CreateSubKey -bor [int][System.Security.AccessControl.RegistryRights]::Delete);$open=[System.Security.AccessControl.RegistryRights]([int][System.Security.AccessControl.RegistryRights]::ReadPermissions -bor [int][System.Security.AccessControl.RegistryRights]::ChangePermissions);$sid=New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0');$rule=New-Object System.Security.AccessControl.RegistryAccessRule($sid,$deny,[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Deny);foreach($base in @([Microsoft.Win32.Registry]::CurrentUser,[Microsoft.Win32.Registry]::LocalMachine)){$k=$base.OpenSubKey('Software\Classes\%EXT%',[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,$open);if($k){$acl=$k.GetAccessControl();$acl.RemoveAccessRuleSpecific($rule);$k.SetAccessControl($acl);$k.Close()}}"

  57. reg delete "HKCU\Software\Classes\%EXT%" /f >nul 2>&1
  58. reg delete "HKLM\Software\Classes\%EXT%" /f >nul 2>&1

  60. echo 测试项已清理
  61. pause
复制代码
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

Archiver|手机版|小黑屋|批处理之家 ( 渝ICP备10000708号 )

GMT+8, 2026-8-17 18:34

Powered by Discuz! X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表