on NUMBER sep NUMBER richard bartlett wrote richard i have a customer who is developing some printer driver code to allow custom driver settings n up booklet duplex etc to be saved up to the server to be retrieved by other users the data is being written by a printer driver using the logged on users authentication to a registry key hklm system currentcontrolset control print environments windows nt xNUMBER drivers version NUMBER driver name custom key subkey let me get this straight a registry key is loaded from the server onto the client workstations who can modify it then write it back onto the server s own registry which is not going to use it the question is what are the security risks of allowing users to write to this key the data is string data in the form of delimited numeric values this data is then retrieved by capable printer drivers and interpreted the risks as i see it are twofold NUMBER the risks of a compromise to the server using this registry key i think this is unlikeley as the server itself does not use this data only client pc s do unless someone knows a way to travel out of a hive up the registry bypassing the permissions set using regedtNUMBER what is the reason to write a registry key to a server if the server itself is not using it i don t think you should worry too much about someone travelling out of the hive but again i m curious as to how the driver actually modifies the keys on the server NUMBER the risks of a compromise to the client far more likely this would probably be by a malformed or extremely long string in the key value which would presumably lead to either dos or system compromise by buffer overflow on the client system and if the client writes the key back onto the server yes there s wide open for something nasty here two other things spring to mind NUMBER if anyone can modify the key how do you make sure that two users are not overwriting the same key thereby causing undesirable effects NUMBER if anyone have permissions to write to the key and below anyone can create thousands of extra keys under this key thereby filling up the registry the result of such a thing is obvious if i got this all wrong i d be happy that you clarify a bit more and tell me where i might have misunderstood med venlig hilsen best regards allan jensen si hoc signum legere potes operis boni in rebus latinus alacribus et fructuosis potiri potes 