PS C:\Windows\system32> $acl = Get-Acl "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells"
$person = [System.Security.Principal.NTAccount]"BUILTIN\Administrators"
$access = [System.Security.AccessControl.RegistryRights]"FullControl"
$inheritance = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
$propagation = [System.Security.AccessControl.PropagationFlags]"None"
$type = [System.Security.AccessControl.AccessControlType]"Allow"
$rule = New-Object System.Security.AccessControl.RegistryAccessRule($person,$access,$inheritance,$propagation,$type)
$acl.AddAccessRule($rule)
$acl |Set-Acl
Set-Acl : Requested registry access is not allowed.
At line:9 char:7
+ $acl |Set-Acl
+ ~~~~~~~
+ CategoryInfo : PermissionDenied: (HKEY_LOCAL_MACH...AlternateShells:String) [Set-Acl], SecurityException
+ FullyQualifiedErrorId : System.Security.SecurityException,Microsoft.PowerShell.Commands.SetAclCommandpfsense здесь, а сессии тонких клиентов за границей и обращаются к сквиду внутри сессий?
Правильно понял?
