RegSaveKeyEx Requires Elevation?

Question

I have code that uses Win API function RegSaveKeyEx to save registry entries to a file. However, RegSaveKeyEx returns ERROR_PRIVILEGE_NOT_HELD when run on Win Vista or Win 7. The code enables security privilege SE_BACKUP_NAME using code Microsoft provides in example function SetPrivilege.

Everything works fine on Win XP (admin user) or if I disable UAC on Win Vista or Win 7. Is it not possible to use RegSaveKeyEx on Vista without elevating the process?

Answer 1

Standard users do not have SE_BACKUP_NAME privilege, so no, RegSaveKeyEx will not work on Vista without elevation.

Backup is one of the very "dangerous" privileges - it enables you to basically read anything on disk regardless of ACL's.

Answer 2

You could give permission the specific user (or group) by going to the following ...

Control Panel->
  Administrative Tools->
    Local Security Policy->
      Local Policies->
        User Rights Assignment-> Back up files and directories (SE_BACKUP_NAME)

... and adding the user (or group) you want. Or you could add the users to Backup Operators.

But, you should be cautious here. See great comment below by Michael.