I'm using Win xp home, when i try to run Regedit i get this message
"Registry editing has been disabled by your administator" and i am the
administrator, this problem started about a week ago. i ran a full
system scan with Norton AV many times but nothing was found.

how do i fix this?

---

Request for Question Clarification by cerebrate-ga on 29 Apr 2004 09:34 PDT

Dear desert_rose-ga,

This particular message is due to the "Prevent access to registry
editing tools" policy having been enabled, which requests Windows
registry editing tools not to run. It's intended for use in corporate
environments to prevent users from altering their own workstations.

On a XP Home machine such as yours, however, the most likely thing to
have enabled this policy is a piece of so-called "spyware" or "adware"
which has sneaked its way on to your system. As these aren't
technically viruses, Norton Antivirus won't pick them up.

As a first step, I suggest you download "Spybot Search & Destroy" from

http://www.safer-networking.org

and run it on your machine to detect and remove any such software
that's present. I suggest you use it's built-in update function first
to make sure that everything is properly detected.

Let me know where this takes you. If it doesn't find anything, or if
it finds and removes something but doesn't re-enable your registry
editing tools, there's another step we can try.

Regards,

cerebrate-ga

---

Clarification of Question by desert_rose-ga on 01 May 2004 09:19 PDT

I downloaded Spybot S&D, ran it, and found some adwares and spywares
and deleted them, restarted my pc, went to run and typed "Regedit" and
the same message appeared "Registry editing has been disabled by your
administator".

Dear desert_rose-ga,

Great. Those will almost certainly have been the software that
originally set the policy that blocked your registry-editing capacity,
so now that they're gone, we can set it back on without worrying about
them setting it back.

There are two stages to completing the fix. First, the adware might
originally have set the policy itself to "enabled", and then Windows
itself would enforce the restriction for it.

To fix this, run "gpedit.msc" from Start/Run... . This tool lets you
open the Local Computer Policy for your machine. In the tree on the
left, browse down to "User Configuration" / "Administrative Templates"
/ "System".

Then, in the list of polices in the right-hand pane, look for "Prevent
access to registry editing tools". This should normally be set to "Not
configured"; if, instead, it is set to "Enabled", double-click on it
to open its properties, and set it back to "Not configured".

However, it's also possible that the adware simply set the registry
setting corresponding to this policy (which dvati0n-ga mentions below
in his comment) without setting the policy itself. Unfortunately, if
you try his suggested method of repair, you'll find that you can't
reset this policy using a .reg file while the policy is in effect, as
that requires Registry Editor to be able to run.

That said, it is possible for another program to reset this. The
easiest way to achieve this is to take advantage of the .NET
Framework, which you may already have installed on your machine, or
which (if not) you can easily download through Windows Update.

With it installed, copy and paste the following into a file on your
machine named "restorereg.cs":

using System;
using Microsoft.Win32;

class RestoreReg
{
    static void Main ()
    {
        RegistryKey polKey = Registry.CurrentUser.OpenSubKey
(@"Software\Microsoft\Windows\CurrentVersion\Policies\System", true) ;
        polKey.SetValue ("DisableRegistryTools", 0) ;
        polKey.Flush () ;
    }
}

Once you've done that, open a Command Prompt, and change to the
directory in which you saved the restorereg.cs file. Then, type the
following line at the prompt, and hit return:

c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe restorereg.cs

(Substitute the directory you installed Windows into if it isn't C:\WINDOWS.)

When you do this, a file named "restorereg.exe" will be created in
that directory. Run it, and you should find that regedit works for you
again.

That should be all that's required, but if you run into any trouble
getting it to work, please feel free to request a clarification.

Regards,

cerebrate-ga

Search strategy:

Personal knowledge as sysadmin.

---

Request for Answer Clarification by desert_rose-ga on 01 May 2004 10:02 PDT

When i typed gpedit.msc, i got this message "Windows cannot find
'gpedit.msc'. Make sure you typed the name correctly...."

---

Clarification of Answer by cerebrate-ga on 01 May 2004 11:36 PDT

My apologies; I'm afraid I mis-checked one detail. gpedit.msc is only
present as standard on XP Pro systems, rather than XP Home.

This being the case, you'll need to use the second method to unset the
registry setting for the policy directly, and this should be
sufficient to restore the machine to normal operation.

Regards,

cerebrate-ga

---

Request for Answer Clarification by desert_rose-ga on 02 May 2004 04:40 PDT

and what is the second method ?

---

Clarification of Answer by cerebrate-ga on 02 May 2004 06:47 PDT

In the second half of the original answer, above, I outlined a method
of resetting the offending registry setting using the .NET Framework
under XP. That's what I meant; sorry if that wasn't clear. The setting
in question still exists under Windows XP Home; it's only the normal
interface to set and reset it that doesn't.

Regards,

cerebrate-ga

---

Request for Answer Clarification by desert_rose-ga on 02 May 2004 07:46 PDT

it's not clear.

your answer was not clear at all and it did not fix my problem.

Are you running from the admin account or are running from "Your Name?"

--John

My browser was hijacked last week, and one of the nasty things it did
was disable my registry editor. I think it does it during startup
using a command line

Go to control panel > User accounts > then select your user name and
click change account type to "administrator"

Go to start -> run then type in "secpol.msc" 
Take a look in there, there should be a policy about changing the regestry.

The account i'm on is the administrator account.

If you're sure your're a amin. Try this:

Go to start -> run then type in "secpol.msc" 
Take a look in there, there should be a policy about changing the regestry.

If you are logged on using an *ADMINISTRATIVE ACCOUNT*, then try
opening notepad and pasting the following information into it...


Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000



In notepad, go to File, Save... and save the file (using quotes) as "regedit.reg"
Now close notepad and double click this file you just saved. You
should be able to access the registry again after performing this
procedure if you are actually an Administrator.

In the second half of the original answer, above, I outlined a method
of resetting the offending registry setting using the .NET Framework
under XP. That's what I meant; sorry if that wasn't clear. The setting
in question still exists under Windows XP Home; it's only the normal
interface to set and reset it that doesn't.

Regards,

cerebrate-ga

yeh i finally get my registry freedom =p
thanks mates