Add ACL support to Registry resources

Cargo.toml

@@ -290,7 +290,7 @@ urlencoding = { version = "2.1" }
 which = { version = "8.0.6" }
 # dsc-lib
 ipnetwork = { version = "0.21" }
-# WindowsUpdate, windows_service, dsc-lib (ACL checks)
+# WindowsUpdate, windows_service, dsc-lib (ACL checks), dsc-lib-registry
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_WindowsFirewall",
@@ -299,6 +299,7 @@ windows = { version = "0.62", features = [
     "Win32_System_Com",
     "Win32_System_Memory",
     "Win32_System_Ole",
+    "Win32_System_Registry",
     "Win32_System_Services",
     "Win32_System_Variant",
     "Win32_System_UpdateAgent",

docs/reference/resources/Microsoft/Windows/Registry/index.md

@@ -1,6 +1,6 @@
 ---
 description: Microsoft.Windows/Registry resource reference documentation
-ms.date:     03/25/2025
+ms.date:     10/13/2026
 ms.topic:    reference
 title:       Microsoft.Windows/Registry
 ---
@@ -35,6 +35,7 @@ resources:
       keyPath: string
       # Instance properties
       _exist:
+      acl:
       valueData:
       valueName:
 ```
@@ -46,6 +47,7 @@ values. The resource can:
 
 - Add and remove registry keys.
 - Add, update, and remove registry values.
+- Retrieve and configure registry key access control lists (ACLs).
 
 > [!NOTE]
 > This resource is installed with DSC itself on Windows systems.
@@ -106,6 +108,7 @@ The following list describes the properties for the resource.
   They define the desired state for an instance of the resource.
 
   - [_exist](#_exist) - Defines whether the registry key or value should exist.
+  - [acl](#acl) - Defines the registry key ACL in Security Descriptor Definition Language (SDDL).
   - [valueData](#valuedata) - The data for a registry value.
   - [valueName](#valuename) - The name of the registry value.
 
@@ -162,6 +165,28 @@ value for `_exist` is `true`, the resource adds or creates the instance if it do
 the value for `_exist` is `false`, the resource removes or deletes the instance if it does exist.
 The default value for this property when not specified for an instance is `true`.
 
+### acl
+
+<details><summary>Expand for <code>acl</code> property metadata</summary>
+
+```yaml
+Type             : string
+IsRequired       : false
+IsKey            : false
+IsReadOnly       : false
+IsWriteOnly      : false
+```
+
+</details>
+
+Defines the registry key ACL in Security Descriptor Definition Language (SDDL). For **Get**
+operations, include the owner (`O:`), group (`G:`), or discretionary access control list (`D:`)
+section in the input to retrieve those sections. For **Set** operations, the resource applies only
+the sections specified in the SDDL string. System access control lists (`S:`) aren't supported.
+
+This property applies to the key identified by `keyPath`, including when the instance also specifies
+a registry value. ACL operations aren't supported when using an offline registry hive.
+
 ### valueData
 
 <details><summary>Expand for <code>valueData</code> property metadata</summary>
@@ -378,6 +403,9 @@ non validating keywords are omitted.
         }
       }
     },
+    "acl": {
+      "type": "string"
+    },
     "keyPath": {
       "type": "string",
       "pattern": "^(HKCR|HKEY_CLASSES_ROOT|HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU|HKEY_USERS|HKCC|HKEY_CURRENT_CONFIG)\\\\"

lib/dsc-lib-registry/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dsc-lib-registry"
-version = "1.2.0"
+version = "1.3.0"
 edition = "2024"
 
 [package.metadata.i18n]
@@ -22,6 +22,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 utfx = { workspace = true }
+windows = { workspace = true }
 
 [build-dependencies]
 cc = { workspace = true }

lib/dsc-lib-registry/locales/en-us.toml

@@ -4,19 +4,25 @@ _version = 1
 # No localizable strings
 
 [error]
+acl = "Registry ACL"
+invalidAcl = "The SDDL must define an owner, group, or DACL"
 invalidHive = "Invalid hive"
 json = "JSON"
 offlineRegistry = "Offline registry"
+offlineAcl = "ACL operations are not supported for offline registries"
 offlineValueEnumeration = "Value enumeration is not supported for offline registries"
 registry = "Registry"
 registryKey = "Registry key"
 registryKeyNotFound = "Registry key not found"
 registryValue = "Registry value"
+saclUnsupported = "System ACLs (SACLs) are not supported"
 utf16Conversion = "UTF-16 conversion failed due to interior NULL values for"
 unsupportedValueDataType = "Unsupported registry value data type"
+win32 = "%{operation} failed with error code %{code}"
 
 [registry_helper]
 whatIfCreateKey = "Key '%{subkey}' not found, would create it"
+whatIfSetAcl = "Would set ACL on key '%{key_path}'"
 whatIfDeleteValue = "Would delete value '%{value_name}'"
 whatIfDeleteSubkey = "Would delete subkey '%{subkey_name}'"
 whatIfDeleteNonexistingKey = "Key '%{subkey}' not found, would do nothing"