RegistryAccessEntry resource does not resolve out-of-box SID on Server 2019 and Windows 10/11

[kevinpagliarulo]

RegistryAccessEntry resource does not resolve out of box SID used in permissions on HKLM:\SOFTWARE and HKLM:\SYSTEM starting in Server 2019 and Windows 10 (1809+), including Server 2022 and Windows 11.

Applying DSC configuration to set permissions on HKLM:\SOFTWARE with "force" param removes this SID, which is problematic. Attempting to add this SID to the DSC resource causes an error, as it can not resolve to a friendly name, which is by design with capability SIDs.

SID: S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681

This is a capability SID and should not be removed from the permissions of HKLM:\SOFTWARE or \SYSTEM:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/sids-not-resolve-into-friendly-names#cause

[brwilkinson]

commenting to follow

[quillypowers]

This is a showstopper for me too..

[kevinpagliarulo]

In case this helps anybody, I found a way to add the SID back to the registry permissions via PowerShell if it was previously removed, since the regedit GUI errors out on the SID.

$sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681")
$key = "HKLM:\SYSTEM" #or "HKLM:\SOFTWARE"
$acl = Get-Acl -Path $key
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
    $sid,
    [System.Security.AccessControl.RegistryRights]::ReadKey,
    [System.Security.AccessControl.InheritanceFlags]::ContainerInherit,
    [System.Security.AccessControl.PropagationFlags]::None,
    [System.Security.AccessControl.AccessControlType]::Allow
)
$acl.SetAccessRule($rule)
Set-Acl -Path $key -AclObject $acl