ZCM 10 is unable to update certain HKCU registry keys

  • 7001671
  • 09-Mar-2009
  • 27-Apr-2012

Environment

Novell ZENworks 10 Configuration Management with Support Pack 1 - 10.1

Situation

If the logged on user does not have write permission to a HKCU key, then ZCM will not be able to update that key since the user's permissions are used to edit the key.

Resolution

This is fixed in version 10.2.1 - see KB 7003766 "ZENworks 10 Configuration Management 10.2.1 - update information and list of fixes" which can be found at https://www.novell.com/support
 
After applying the update, ZCC now has a new option on registry edit settings when running as system user: "Apply HKEY_CURRENT_USER changes to the logged in user's hive instead of .DEFAULT "
 
To allow system run registry actions to operate for user:
 
  1. Make HKLM and HKCU run in different actions.
  2. Ensure that HKLM actions are set to run as system.
  3. Ensure that HKCU actions are set to run as system and check the option Apply HKEY_CURRENT_USER changes to the logged in user's hive instead of .DEFAULT.

Additional Information

  • By default, the new setting is unchecked when Run Action as System is selected.  This maintains compatibility with bundles created in previous versions.
  • This setting is meant for applying changes for HKCU keys.  If it is not checked, HKCU keys changes will be done in .DEFAULT hive under HKEY_USERS.  This maintains compatibility with bundles created in previous versions.
  • If the setting is checked, then HKCU key changes will be done in the logged in user's SID hive under HKEY_USERS , which in turn will be reflected back in HKCU hive.  This allows bypass of restricted HKCU keys which need system privileges.  
    But if no user is logged in, then key changes will be done in .DEFAULT hive under HKEY_USERS .
  • HKCU non-restricted key changes can still be done running action in User context. When Run Action as User is selected, the checkbox will remain disabled.
  • When the agent runs the action as System, the value of the checkbox will carry no meaning for keys changes to be done in hives other than HKCU .