RegOpenKeyEx 返回错误代码 5

Question

我想获取 Windows 注册表中某些受保护注册表项的最后修改时间。例如，我正在尝试打开注册表项：

HKLM\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00\4C531001530301123274&0\Properties

使用RegOpenKeyEx，但它返回error code 5，这意味着访问被拒绝。

我的程序适用于未受保护的注册表项。我已禁用 UAC 并以“以管理员身份运行”身份运行我的程序

这是我的代码：

public DateTime GetKeyModifiedTime(string computerName, string BaseKey, string SubKey)
    {
        int remoteKeyResult = -1;

        try
        {
            if (BaseKey.Equals("HKEY_LOCAL_MACHINE"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_LOCAL_MACHINE), ref longResult);
            if (BaseKey.Equals("HKEY_CURRENT_USER"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_CURRENT_USER), ref longResult);
            if (BaseKey.Equals("HKEY_USERS"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_USERS), ref longResult);


            int abasekey = 0;
            abasekey = ParseInput(BaseKey);
            //parse just the base key part and return the Integer enum value of the base key
            int BaseKeyValue = 0;
            //if the value of abasekey is not -1(used for error) then set BaseKeyValue to the returned vaue
            if (!(abasekey == -1))
            {

                BaseKeyValue = abasekey;

            }
            else
            {
                //if abasekey does = -1 then bail out because input is not correct.
            }

            int regkeyptr = 0;
            IntPtr p = new IntPtr(regkeyptr);

            int openregkeyResult = RegOpenKeyEx(longResult, SubKey, 0, KEY_QUERY_VALUE, ref p);


            //third param is Reserved and must be 0(worked as "Nothing" also)
            //strbldr.AppendLine("Open RegKey Pointer " + regkeyptr.ToString());
            // strbldr.AppendLine("Open RegKey Result " + openregkeyResult.ToString());

            //create a filetime structure to recieve the returned time
            System.Runtime.InteropServices.ComTypes.FILETIME lpftLastWriteTime = default(System.Runtime.InteropServices.ComTypes.FILETIME);

            int returnvalue = 0;

            returnvalue = RegQueryInfoKey(p.ToInt32(), null, 0, 0, 0, 0, 0, 0, 0, 0, 0, ref lpftLastWriteTime);

            //strbldr.AppendLine("RegQueryInfoKey Result " + returnvalue);
            //returnvalue is the HResult call of RegQueryInfoKey
            //strbldr.AppendLine();
            //strbldr.AppendLine("Filetime High " + lpftLastWriteTime.dwHighDateTime.ToString() + "   " + "Filetime Low  " + lpftLastWriteTime.dwLowDateTime.ToString());
            //use the api function to convert the filetime to a date time This ine returns in local time, File TIme is UTC 0 based.
            DateTime dt = FileTimeToDateTime(lpftLastWriteTime);
            return dt;


        }
        catch (Exception ex)
        {
            return DateTime.Now;

        }
    }

Answer 1

因为你在RegOpenKeyEx()中设置了KEY_QUERY_VALUE。 只需更改为KEY_READ。会好的。

Answer 2

如您所说，错误 5 是拒绝访问。某些注册表项归系统或其他帐户所有，其他所有人都被拒绝访问。如果您在 regedit 中转到该键，则可以查看其权限。它可能归 SYSTEM 所有。