Add ACL support to Registry resources

[Steve Lee (SteveL-MSFT)]

Registry keys need a declarative way to retrieve and enforce access control alongside their values. This adds an acl SDDL property to both Microsoft.Windows/Registry and each Microsoft.Windows/RegistryList entry.

The implementation uses Windows registry security APIs with scoped handle/allocation cleanup, applies only the owner, group, and DACL sections supplied by the caller, and returns the same requested sections so synthetic DSC testing remains idempotent. What-if projects ACL changes without mutation. SACL and offline-hive ACL operations are rejected explicitly because they are not supported.

Tests cover single and list get/set behavior, what-if non-mutation, SDDL validation and parsing, and existing registry scenarios. The resource reference documentation describes the new property and its constraints.

Validation:

• ./build.ps1 -Project registry -Clippy -Test -ExcludePesterTests
• Targeted Registry and RegistryList ACL Pester tests

[Copilot]

🟡 Changes recommended

ACL inheritance flags and permission handling can prevent the requested security state from being enforced correctly.

4 open findings

• Parenthesis scanner misparses quoted conditional ACE values · New
• DACL inheritance protection flags are not preserved · New
• ACL-only updates incorrectly require read access · New
• Hard-coded error message bypasses localization · New

What changed in this PR

Adds declarative SDDL-based ACL retrieval and enforcement for Windows Registry resources.

Changes:

• Implements ACL get/set, validation, what-if, and cleanup.
• Adds Registry and RegistryList ACL tests.
• Updates schemas, dependencies, localization, and documentation.

File	Description
Cargo.toml	Enables Windows Registry APIs.
Cargo.lock	Records the Windows dependency.
lib/​dsc-lib-registry/​Cargo.toml	Adds the Windows crate.
lib/​dsc-lib-registry/​src/​acl.rs	Implements registry ACL operations.
lib/​dsc-lib-registry/​src/​config.rs	Adds the acl property.
lib/​dsc-lib-registry/​src/​error.rs	Adds ACL errors.
lib/​dsc-lib-registry/​src/​lib.rs	Integrates ACL behavior.
lib/​dsc-lib-registry/​locales/​en-us.toml	Adds ACL messages.
resources/​registry/​tests/​registry.config.get.tests.ps1	Tests ACL retrieval.
resources/​registry/​tests/​registry.config.set.tests.ps1	Tests ACL enforcement.
resources/​registry/​tests/​registry.config.whatif.tests.ps1	Tests ACL what-if behavior.
resources/​registry/​tests/​registrylist_get.tests.ps1	Tests list ACL retrieval.
resources/​registry/​tests/​registrylist_set.tests.ps1	Tests list ACL enforcement.
resources/​registry/​tests/​registrylist_whatif.tests.ps1	Tests list ACL what-if behavior.
docs/​reference/​resources/​Microsoft/​Windows/​Registry/​index.md	Documents ACL support.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

ACL retrieval over-requests permissions and skips SDDL validation when the target key is absent.

1 open finding

• Use READ_CONTROL for ACL-only registry security reads · New

4 resolved since last review

• ACL-only updates incorrectly require read access
• DACL inheritance protection flags are not preserved
• Parenthesis scanner misparses quoted conditional ACE values
• Hard-coded error message bypasses localization

Previously missed (1)

In code that hasn't changed since last review

Validate ACL before checking whether the registry key exists

lib/​dsc-lib-registry/​src/​lib.rs:159

A missing live key returns _exist: false before this ACL is parsed, so malformed SDDL and unsupported S: input are accepted by get whenever the key does not exist. That contradicts the explicit SACL rejection and makes validation depend on current machine state. Validate the requested ACL before the key-existence lookup.

🧠 Review effort: Balanced