top of page

OUR PRECONDITIONS

  • The old network infrastructure, referred to as OldNet:
    Doesn’t support 802.1x.
    Two domains on different VLAN’s with a one way trust, referred to as Enterprise and Educational.
    The two domains have their own network infrastructure, different IP Helpers, DNS, DHCP and so on.

  • The new infrastructure, referred to as NewNet:
    802.1x is required using CISCO ISE and Layer 3 switches.
    Only one fallback net with its own IP range, common for both domains, which also supports WebAuth guest access.
    The two domains still have their own IP range, DHCP, DNS etc. but will use the same PXE-server since PXE boot is taking place on the fallback network.

  • Both the old and the new network infrastructure will be used to deploy Windows 10 x64 and Windows 7 x86.

  • MAB will not be used during OSD, the network team don’t want to spread a special OSD VLAN so clients will get an IP address according to its current location and only certificate-based authentication is allowed.

  • The task sequence needs to support both the new computer and refresh scenario as well as BIOS to UEFI conversion regardless of the currently installed operating system.
    The scripts used for managing 802.1x needs to support Windows 7 and its PowerShell version.

Search
Writer's picturesomeguy100
Jul 11, 20191 min read

Set ACL on WinPE registry key prior to boot using a driver

After retweeting my previous post about using a fake driver to modify a boot image I had a great and giving conversation with Andreas Hammarskjöld of 2Pint Software about an obstacle I've never encountered before; the need of setting the ACL of a reg key prior to the boot of the OS (WinPE).

Been busy doing private stuff but this evening I finally got to test what I in that conversation said I believed was possible.... And it is.




So here we go.

This is the inf-file.



I've put [ExampleFileSystem.SetRegistryACL.security] by itself since I bet there are many registry changes to be made and the ".security" sets the ACL for the entire group of reg entries.


So what does that strange line "D:AI(A;CI;GA;;;BU)" actually set?


As I've said, never done this before, but I think this migth be at least ~80% correct.

D=Type dacl.


  • O: owner_sid

  • G: group_sid

  • D: dacl_flags(string_ace1)(string_ace2)... (string_acen)

  • S: sacl_flags(string_ace1)(string_ace2)... (string_acen)


AI=Keep inheritance but add/change the ACL.

(A;CI;GA;;;BU)


Allow, Inherit on subkeys, General access (read+write), Builtin\users




See these links for more info:

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/inf-addreg-directive

https://docs.microsoft.com/sv-se/windows/win32/secauthz/security-descriptor-string-format

https://docs.microsoft.com/sv-se/windows/win32/secauthz/ace-strings

https://docs.microsoft.com/sv-se/windows/win32/secauthz/sid-strings

157 views0 comments

Bình luận

bottom of page