Search code examples
powershellcmdregistryreadonlyregedit

Make registry key under HKEY_LOCAL_MACHINE\HARDWARE persistently read-only


Hello a few days ago I wanted to rename "ProcessorName" in

HKEY_LOCAL_MACHINE \ HARDWARE \ DESCRIPTION \ System \ CentralProcessor \ 0. 

I succeeded, but every time the system was rebooted, windows reverted the changes I made.

With SubACL, I changed the owner of the registry keys to the administrator group, but it still didn't work.

I also tried to put a .reg file to

C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

But I dont want this, as I'm creating a program that allows renaming your CPU name.

I guess if I make this key is "read only", the system cannot change it, it just reads it.

How can I make that happen with cmd, powershell, etc. (without opening regedit)?


Solution

  • I don't think you can ever get a change to survive a reboot by design. As far as I'm aware, HKLM\HARDWARE is volatile data. My understanding is that the entire key is deleted and recreated at each boot by ntdetect.com scanning the system for hardware. So I don't believe that it's going to matter if you make it read only.

    Even if my understanding above is incorrect, ntdetect.com is run by the NT bootloader (NTLDR) before execution has been passed off to the NT kernel (ntoskrnl.exe). Hardware detection runs before the NT kernel has loaded because the kernel needs the list of installed hardware before it can load. I would be surprised if it would respect a write-deny ACLs. I think this is before the security system is even available.

    All I can think you could do would be to create a script or program that executes at startup or login to rename the value, but I guess I don't see the purpose in that.