Registry Permissions after Domain Change

A couple months ago, as part of migrating to Server 2012 Essentials, I created a new Windows domain for my network with the same name as the old domain. I used the ForensIT User Profile Wizard to migrate user profiles. Overall that worked great, but there have been a couple of issues. I blogged about one here. Today I think I cracked another one.

I was trying to install the SkyDrive connector on my 64-bit Windows 7 machine, but it failed with this error:

Registry permissions after domain change 1.png

A web search brought me to this post, where the June 11, 2012 reply by forum moderator Jonathan_V was spot on. My SkyDrive setup log contained this error message:

!ERROR! (0x80070005) RegCreateKeyExW() failed for Key Software\Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6} with Value ISyncEngineCOMServer and use64BitRegistryView = 1

When I checked the permissions on

HKEY_CURRENT_USER\Software\Classes

it correctly shows that my logon (a domain admin account) has Full Control. However when I go down one level to

HKEY_CURRENT_USER\Software\Classes\Interfaces

I see that a) this key’s permissions are not inherited and b) only the SID for my account in the old domain is shown; my new logon is not listed:

Registry permissions after domain change 2

Following Jonathan_V’s advice, I gave my logon with Full Control on that key and voilà! I was able to install the SkyDrive connector.

Inconsistent Permissions

Oddly, I just checked the permissions on a 32-bit Windows 7 virtual machine, and its permissions are quite different:

  • \Classes does not list a domain user at all, simply granting the Administrators group Full Control and the Users group Read permission. 
  • \Classes\Interface just inherits from \Classes.

Sure enough, SkyDrive installs fine in this VM.

Since my logon and the Domain Admins group are members of the local Administrators group on both computers, I don’t understand why that wasn’t enough to grant permissions on the first machine to write to \Classes\Interface. UAC is set to Notify on both machines.

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.