WARNING! This post requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Virtual Engine cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you begin. If this hasn’t scared you off keep reading….
In my time installing and configuring applications for multi user environments like XenApp or RDS, I come across many applications that will create context menus within Windows explorer that can help a user quickly perform a function. The screen shot below shows how WINRAR has added context menus in Windows explorer that allows the user to easily create a .RAR file having selected file(s) or folder(s).
Generally these context menus are machine based, i.e. any user that logs in to a XenApp server will be able to see and use these context menus. On the face of things you might ask yourself why would this be a problem? Well suppose this application is strictly licensed for particular/named users. Therefore, you wouldn’t want anyone having the option to use them otherwise you would need to license the application for all users! In this case what you’d really like is to only have them available to users whom are licensed or whom you deem need them. A typical example of this might be Adobe Acrobat Professional that adds in a context menu to combine documents to single PDF.
The good news is there is a way of moving them from being machine based to per user with some fancy manipulation of various registry keys. So lets begin using our example of WINRAR and see how this can be done.
Firstly, we need to understand where context menus are located within the registry. From my experience when you right click on file(s) within windows explorer the context menus will be found in:
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
Here’s an example with WinRAR:
When you right click on folder(s) within windows explorer the context menus will be found in one or both of the following registry locations:
HKEY_CLASSES_ROOT\Folder\ShellEx\ContextMenuHandlers HKEY_CLASSES_ROOT\Directory\ShellEx\ContextMenuHandlers
Below is a screen shot showing these registry keys for WinRAR:
So now we know where they are located we should open up the registry editor (REGEDIT.EXE) and export the context menu registry keys that we would like to make per user to .REG files (saving them to a location for safe keepings should you need to revert it back!).
What we need to do next is take a copy of those same registry (.REG) files so we can edit them. Using those copies open them in say notepad and replace HKEY_CLASSES_ROOT with HKEY_CURRENT_USER\Software\Classes (this is where the equivalent registry keys are kept for a user). It should now look something like this; using WinRAR as the example. Once completed save and close the .REG file.
Now we get dangerous (well not really if you’re in the registry all time adding, deleting and generally tinkering – sound familiar?!?). The next step requires us to alter the permissions of those context menu registry keys located in:
HKEY_CLASSES_ROOT\Folder\ShellEx\ContextMenuHandlers HKEY_CLASSES_ROOT\Directory\ShellEx\ContextMenuHandlers HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
Again using WINRAR as the example I would open up REGEDIT.EXE and browse to the following locations:
HKEY_CLASSES_ROOT\Folder\ShellEx\ContextMenuHandlers\WinRAR HKEY_CLASSES_ROOT\Directory\ShellEx\ContextMenuHandlers\WinRAR HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
Modify the ‘Users’ permissions from ‘Read’ to ‘Deny’ on each registry key (as listed above) like so:
Having changed those permissions you have successfully removed the context menus from a per machine basis or more precisely denied access to users and administrators. I’m no fan of doing things manually so I try and automate where possible. My choice of tool to change the registry key permissions in that automated fashion would be to use RES Automation Manager which has a built-in task to manage registry key functions, e.g. registry permissions. Unfortunately there appears to be a bug – which has been logged with RES Support – in RES Automation Manager for this task when the registry key contains “*” i.e.
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
So I turned to the ever reliable SetACL from Helge Klein (follow Helge on Twitter here) to set the required registry permissions and added the command line into my RES Automation Manager job. For any existing users of RES Automation Manager I’ve attached a handy building block (just click on the big red brick) that can be used and manipulated for your needs to change those permissions as described above.
[wpdm_file id=9]
In Part II of this blog post I’ll describe how you go about targeting these same context menus at specific users 
.
Enjoy!
Nathan
Simon
I previously covered the reasons why you probably wouldn’t use RES Automation Manager for patch management (see 
..