get original permissions of registry key (for users/groups) by command line (batch)
<p>I want to get original permissions of registry key (for users/groups) by command line (batch)</p>

<p>Example routine:</p>

<pre><code>1. get original permissions of key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [??????]
(this is the part what i want to know)

2. Unblock key:
@echo HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [1 17] &gt;&gt;c:\unblock.txt
%windir%\system32\regini.exe c:\unblock.txt

3. Modify/delete/add content:
reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v BlaBla /f

4. Restore Original permissions:
@echo HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [??????] &gt;&gt;c:\restore.txt
%windir%\system32\regini.exe c:\restore.txt
</code></pre>

<p>I try with <a href="https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe" rel="nofollow">SetACL</a>...</p>

<pre><code>SetACL.exe -on "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" -ot reg -actn list &gt; keypermission.txt
</code></pre>

<p>But the output format is not compatible with regini (out without numbers)</p>

<pre><code>current_user\Software\Microsoft\Windows NT\CurrentVersion\Windows

DACL(pseudo_protected):
Administradores   full   allow   container_inherit
CREATOR OWNER   full   allow   container_inherit
Todos   read   allow   container_inherit
SYSTEM   full   allow   container_inherit

SetACL finished successfully.
</code></pre>

<p>I try with Powershell...</p>

<pre><code>Get-Acl -Path HKLM:\"Software\Microsoft\Windows NT\CurrentVersion\Windows" | Format-List
</code></pre>

<p>But the output format is not compatible with regini (out without numbers)</p>

<pre><code>Path   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
Owner  : BUILTIN\Administradores
Group  : BUILTIN\Administradores
Access : Todos Allow  ReadKey
     CREATOR OWNER Allow  FullControl
     NT AUTHORITY\SYSTEM Allow  FullControl
     BUILTIN\Administradores Allow  FullControl
Audit  :
Sddl   : O:BAG:BAD:P(A;CI;KR;;;WD)(A;CI;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KA;;;BA)
</code></pre>

<p><strong>I need a solution compatible with <a href="http://ss64.com/nt/regini.html" rel="nofollow">regini</a> (with numbers):</strong></p>

<pre><code>1  - Administrators Full Access
2  - Administrators Read Access
3  - Administrators Read and Write Access
4  - Administrators Read, Write and Delete Access
5  - Creator Full Access
6  - Creator Read and Write Access
7  - World Full Access
8  - World Read Access
9  - World Read and Write Access
10 - World Read, Write and Delete Access
11 - Power Users Full Access
12 - Power Users Read and Write Access
13 - Power Users Read, Write and Delete Access
14 - System Operators Full Access
15 - System Operators Read and Write Access
16 - System Operators Read, Write and Delete Access
17 - System Full Access
18 - System Read and Write Access
19 - System Read Access
20 - Administrators Read, Write and Execute Access
21 - Interactive User Full Access
22 - Interactive User Read and Write Access
23 - Interactive User Read, Write and Delete Access
</code></pre>

<p><strong>Please only command line cmd/batch (not GUI).</strong></p>

<p><strong>Update</strong>:</p>

<p>I found a possible solution, but I need to automate in batch:</p>

<p>Export key and found value:</p>

<pre><code>reg export "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" export.reg /y &amp;&amp; type export.reg | findstr /i "target"
</code></pre>

<p>Modify "target"</p>

<pre><code>???
</code></pre>

<p>Import key with new value (overwrite old value)</p>

<pre><code>reg import export.reg
</code></pre>