title: get original permissions of registry key (for users/groups) by command line (batch)
body: <p>I want to get original permissions of registry key (for users/groups) by command line (batch)</p>
  
  <p>Example routine:</p>
  
  <pre><code>1. get original permissions of key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [??????]
  (this is the part what i want to know)
  
  2. Unblock key:
  @echo HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [1 17] &gt;&gt;c:\unblock.txt
  %windir%\system32\regini.exe c:\unblock.txt
  
  3. Modify/delete/add content:
  reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v BlaBla /f
  
  4. Restore Original permissions:
  @echo HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows [??????] &gt;&gt;c:\restore.txt
  %windir%\system32\regini.exe c:\restore.txt
  </code></pre>
  
  <p>I try with <a href="https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe" rel="nofollow">SetACL</a>...</p>
  
  <pre><code>SetACL.exe -on "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" -ot reg -actn list &gt; keypermission.txt
  </code></pre>
  
  <p>But the output format is not compatible with regini (out without numbers)</p>
  
  <pre><code>current_user\Software\Microsoft\Windows NT\CurrentVersion\Windows
  
  DACL(pseudo_protected):
  Administradores   full   allow   container_inherit
  CREATOR OWNER   full   allow   container_inherit
  Todos   read   allow   container_inherit
  SYSTEM   full   allow   container_inherit
  
  SetACL finished successfully.
  </code></pre>
  
  <p>I try with Powershell...</p>
  
  <pre><code>Get-Acl -Path HKLM:\"Software\Microsoft\Windows NT\CurrentVersion\Windows" | Format-List
  </code></pre>
  
  <p>But the output format is not compatible with regini (out without numbers)</p>
  
  <pre><code>Path   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
  Owner  : BUILTIN\Administradores
  Group  : BUILTIN\Administradores
  Access : Todos Allow  ReadKey
       CREATOR OWNER Allow  FullControl
       NT AUTHORITY\SYSTEM Allow  FullControl
       BUILTIN\Administradores Allow  FullControl
  Audit  :
  Sddl   : O:BAG:BAD:P(A;CI;KR;;;WD)(A;CI;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KA;;;BA)
  </code></pre>
  
  <p><strong>I need a solution compatible with <a href="http://ss64.com/nt/regini.html" rel="nofollow">regini</a> (with numbers):</strong></p>
  
  <pre><code>1  - Administrators Full Access
  2  - Administrators Read Access
  3  - Administrators Read and Write Access
  4  - Administrators Read, Write and Delete Access
  5  - Creator Full Access
  6  - Creator Read and Write Access
  7  - World Full Access
  8  - World Read Access
  9  - World Read and Write Access
  10 - World Read, Write and Delete Access
  11 - Power Users Full Access
  12 - Power Users Read and Write Access
  13 - Power Users Read, Write and Delete Access
  14 - System Operators Full Access
  15 - System Operators Read and Write Access
  16 - System Operators Read, Write and Delete Access
  17 - System Full Access
  18 - System Read and Write Access
  19 - System Read Access
  20 - Administrators Read, Write and Execute Access
  21 - Interactive User Full Access
  22 - Interactive User Read and Write Access
  23 - Interactive User Read, Write and Delete Access
  </code></pre>
  
  <p><strong>Please only command line cmd/batch (not GUI).</strong></p>
  
  <p><strong>Update</strong>:</p>
  
  <p>I found a possible solution, but I need to automate in batch:</p>
  
  <p>Export key and found value:</p>
  
  <pre><code>reg export "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" export.reg /y &amp;&amp; type export.reg | findstr /i "target"
  </code></pre>
  
  <p>Modify "target"</p>
  
  <pre><code>???
  </code></pre>
  
  <p>Import key with new value (overwrite old value)</p>
  
  <pre><code>reg import export.reg
  </code></pre>