How to adjust access on create/open registry key ?

Hello!
Example: on RegNtPreCreateKeyEx / RegNtPreOpenKeyEx with DesiredAccess = MAXIMUM_ALLOWED I want to grant only read access.

Is there some way to to that ?

I can use GrantedAccess member but only with Status_callback_bypass (if I understand correctly )and this requires to open key myself, which sounds like recursion

You can change the granted access in the post callback.

Thank you Bill ! You mean by changing REG_POST_OPERATION_INFORMATION::PreInformation::GrantedAccess ?

Yes, PreInformation::GrantedAccess.
Remember that NtCreateKey will create the key if it doesn’t exist.

Bill Wandel

Thank you very much Bill !