How Regedit Displays Inherited Permissions

In the Windows Registry Editor (regedit.exe), permissions define what actions specific users and groups can perform on registry keys. To distinguish between permissions created directly on a key and those passed down from a parent key, Regedit uses visual indicators in both the basic Permissions window and the Advanced Security Settings interface. Understanding these visual cues allows administrators to effectively identify, audit, and modify access control inheritance across the registry hierarchy.

The Basic Permissions Window

When you right-click a registry key and select Permissions, Regedit opens a standard access control list (ACL) dialog. In this view:

• Shaded (Greyed-out) Checkboxes: Permissions inherited from a parent key appear with greyed-out checkmarks in the Allow or Deny columns. You cannot modify or clear these checkboxes directly from this window because the settings originate higher up in the registry tree.
• Solid (Clear) Checkboxes: Permissions configured explicitly on the selected key appear with standard, editable black checkmarks on a white background.

The Advanced Security Settings Window

To see exact details about where a permission originated, click the Advanced button in the basic Permissions dialog. The Advanced Security Settings window provides a comprehensive breakdown:

• Inherited From Column: The permissions list includes a dedicated column titled Inherited From. If an Access Control Entry (ACE) is inherited, this column explicitly names the parent key path providing the permission (for example, HKEY_LOCAL_MACHINE\SOFTWARE). If the permission was set directly on the selected key, the column displays <not inherited>.
• Applies To Column: This shows the scope of the rule, indicating whether the permission affects only the current key, its subkeys, or both.
• Inheritance Controls: At the bottom of the window, an inheritance button allows you to control propagation:
  • Disable Inheritance: Removes the link to the parent key, prompting you to either convert inherited permissions into explicit permissions on the current object or remove all inherited permissions entirely.
  • Enable Inheritance: Restores propagation from the parent key, overwriting conflicting explicit entries with inherited ones.

Inheritance Propagation

By default, any subkey created under a parent key inherits the parent’s security descriptors. When you update permissions on a parent key and choose the option to replace child permissions, Regedit pushes those changes down through the hierarchy, updating the shaded permissions and the “Inherited From” paths across all subordinate keys automatically.