Post cover image

August 11, 2026

Windows Endpoint & LOB Application Dependency Engineering: Diagnosing and Remediating Registry and…

EXECUTIVE SUMMARY

By Abiodun Aransiola

11 min read

EXECUTIVE SUMMARY

The Problem

A standard domain user (mraper) attempting to launch a critical Line-of-Business (LOB) application, CorpFinanceTool, on a managed Windows 10 endpoint (CLIENT1) encountered an immediate initialization failure. The application failed during its bootstrap sequence, returning a configuration access error that prevented standard non-administrative users from launching the software.

The Objective

Perform a structured endpoint and application troubleshooting engagement: investigate the OS-level execution chain, isolate the underlying system defects, restore application startup under a standard user context adhering to least-privilege principles, and engineer a repeatable PowerShell automation script for remote deployment over Windows Remote Management (WinRM).

The Investigation & Sequential Discovery

  1. Privilege Context Comparison: Verified that the application initialized successfully under local administrator credentials but failed consistently under standard domain user credentials. The successful administrator execution narrowed the investigation toward user-context and permission differences.
  2. System Call Tracing: Executed Sysinternals Process Monitor (ProcMon) filtered for process activity associated with powershell.exe and CorpFinanceTool. Traces captured ACCESS DENIED on RegOpenKey calls when standard user tokens queried HKLM:\SOFTWARE\CorpFinanceTool. Subsequent registry ACL inspection confirmed that standard users lacked read access.
  3. Secondary Defect Discovery: Resolving the initial registry blocker revealed a secondary startup-blocking defect: a missing dynamic link library (CoreNativeEngine.dll) in the local application binary path.

The Solution & Automation

  • Registry Permission Remediation: Updated the Access Control List (ACL) on HKLM:\SOFTWARE\CorpFinanceTool using PowerShell's System.Security.AccessControl API to grant narrow ReadKey permissions to the standard user context.
  • Dependency Restoration: Restored the missing CoreNativeEngine.dll module into C:\Program Files\CorpFinanceTool\bin\ from the staging location.
  • Remote Automation: Combined the remediation steps into an automated PowerShell script (Fix-CorpFinanceTool.ps1) and executed it remotely from the Domain Controller (DOMAINCON) against CLIENT1 via WinRM (Invoke-Command).

The Validation & Result

Application startup and bootstrap validation succeeded directly within the standard user context (mraper), returning Application launched Successfully!. Post-remediation ProcMon traces confirmed clean SUCCESS outcomes for all registry query operations. Startup recovery was achieved without adding the user to the local Administrators group.

None

ENVIRONMENT & ARCHITECTURE

ARCHITECTURE DIAGRAM

 ┌─────────────────────────────────────────────────────────────────┐
 │                      DOMAINCON (Server 2019)                    │
 │  • Active Directory Domain Services (mydomain.com)               │
 │  • Group Policy Management (GPO_ENDPOINT_OPERATIONAL_BASELINE)  │
 │  • Staging Location (\\DOMAINCON\SoftwareShare)                 │
 └──────────────┬───────────────────────────────────┬──────────────┘
                │                                   │
     WinRM (Port 5985)                   SMB (Port 445)
    [Remote Script Execution]           [Dependency Retrieval]
                │                                   │
                └─────────────────┬─────────────────┘
                                  │
                                  ▼
 ┌─────────────────────────────────────────────────────────────────┐
 │                      CLIENT1 (Windows 10)                       │
 │  • Managed Domain Endpoint                                      │
 │  • Target Application: CorpFinanceTool                          │
 │  • Standard User Context: mraper (Domain Users)                 │
 │  • Target Registry: HKLM:\SOFTWARE\CorpFinanceTool              │
 │  • Binary Directory: C:\Program Files\CorpFinanceTool\bin\      │
 └─────────────────────────────────────────────────────────────────┘

System Tools & Role Summary

+-----------------------+------------------------------------------------------------------------------------+
| Tool / Technology     | Administrative Purpose                                                             |
+-----------------------+------------------------------------------------------------------------------------+
| Active Directory (AD) | Centralized identity management and domain user authentication (mydomain\mraper).  |
| Group Policy (GPMC)   | Domain-wide enforcement of WinRM service configuration and host firewall rules.    |
| WinRM / PS Remoting   | Remote, non-interactive administrative execution (Invoke-Command).                |
| Sysinternals ProcMon  | OS-level application call tracing and registry access monitoring.                  |
| PowerShell 5.1        | Automation scripting, registry ACL modification, and state checking.               |
| icacls.exe / net share| NTFS file-system permission auditing and staging share management.                 |
+-----------------------+------------------------------------------------------------------------------------+
None

INCIDENT / BUSINESS IMPACT

The LOB finance application, CorpFinanceTool, stopped initializing for standard domain users on workstation CLIENT1. Users attempting to open the tool received an immediate terminal error during execution:

PS C:\Users\mraper> powershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\CorpFinanceTool\Launch.ps1"
C:\Program Files\CorpFinanceTool\Launch.ps1 : CRITICAL: Cannot access configuration key ().
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Launch.ps1
None

Note on Execution Policy: The explicit invocation using -ExecutionPolicy Bypass was used as a convenience in the test environment to execute local diagnostic wrappers. Production deployment models rely on signed scripts and enterprise execution policies.

Operational Considerations

  • User Context Boundary: The application launched normally when executed by a local administrator, but failed consistently when executed by standard user mraper.
  • Avoidance of Insecure Workarounds: Frontline support initially considered adding affected users to the local Administrators group. This was rejected because elevating user rights weakens the endpoint security boundary and violates operational baselines.
  • Technical Goal: Isolate the exact system resources denying access to the standard user context, apply a targeted permission fix, restore missing dependencies, and automate the fix for remote deployment without granting local admin rights.

TROUBLESHOOTING METHODOLOGY

The investigation followed a structured decision workflow based on hypothesis testing, privilege comparison, and sequential validation.

TROUBLESHOOTING DECISION PROCESS

                       Application Failure Reported
                                    │
                                    ▼
                     Execute as Administrator Account
                                    │
                  ┌─────────────────┴─────────────────┐
                  │                                   │
              [ Fails ]                           [ Succeeds ]
                  │                                   │
                  ▼                                   ▼
      Investigate Package / OS             Investigate User Context &
      Installation Integrity               Permission Differences
                                                      │
                                                      ▼
                                           Run Sysinternals ProcMon
                                           Filter: powershell.exe
                                                      │
                                                      ▼
                                           Identify OS Call Failure
                                           Result: ACCESS DENIED on RegOpenKey
                                                      │
                                                      ▼
                                            Inspect Registry ACL
                                           Missing ReadKey for User
                                                      │
                                                      ▼
                                           Apply ReadKey Permission
                                                      │
                                                      ▼
                                           Re-test Application
                                                      │
                                                      ▼
                                           Identify Secondary Defect
                                           Missing DLL Component
                                                      │
                                                      ▼
                                           Restore Required File
                                                      │
                                                      ▼
                                           Validate Bootstrap
                                           Outcome: SUCCESS

Hypotheses Tested

+------------------------------------+------------------------------------+------------------------------------+------------------------------------+
| Hypothesis                         | Test Action                        | Result                             | Conclusion                         |
+------------------------------------+------------------------------------+------------------------------------+------------------------------------+
| 1. App installation is corrupt     | Run Launch.ps1 in elevated session | App passed registry stage cleanly  | Ruled Out: Installation intact     |
| 2. User lacks registry read access | Execute Launch.ps1 under ProcMon   | ProcMon captured ACCESS DENIED     | Confirmed (Defect 1): Missing ACL  |
| 3. Required binary missing         | Trace app after granting ACL fix   | Failed at CoreNativeEngine.dll check| Confirmed (Defect 2): Missing DLL  |
| 4. Full OS/App reinstall required  | Evaluate reinstallation necessity   | Targeted ACL + DLL fix succeeded   | Ruled Out: Reinstallation unnecessary|
+------------------------------------+------------------------------------+------------------------------------+------------------------------------+

PROCMON EVIDENCE

Diagnostic Action & Rationale

  • Action: Downloaded and extracted Sysinternals Suite to staging share, then launched Process Monitor (ProcMon64.exe) on CLIENT1.
None None None

Capture Filters Applied:

  1. Process Name is powershell.exe -> Include
  2. Path contains CorpFinanceTool -> Include
None

Role of ProcMon: ProcMon recorded the underlying RegOpenKey system call failure returning ACCESS DENIED. Crucially, ProcMon proved where access was being blocked at runtime, but did not directly prove the complete security descriptor configuration. Direct inspection of the registry ACL via PowerShell (Get-Acl) was required to confirm the missing explicit access rules.

Evidence Captured

Time        Process Name    PID   Operation    Path                            Result        Detail
──────      ────────────    ────  ─────────    ────                            ──────        ──────
07:29:22    powershell.exe  5536  RegOpenKey   HKLM\SOFTWARE\CorpFinanceTool   ACCESS DENIED Desired Access: Read
None

Evidence → Interpretation → Action

┌─────────────────────────────────────────────────────────────────────────┐
 │ EVIDENCE (ProcMon Trace):                                               │
 │ Process 'powershell.exe' returned 'ACCESS DENIED' on 'RegOpenKey'       │
 │ target: HKLM\SOFTWARE\CorpFinanceTool (Desired Access: Read)            │
 └────────────────────────────────────┬────────────────────────────────────┘
                                      │
                                      ▼
 ┌─────────────────────────────────────────────────────────────────────────┐
 │ INTERPRETATION (ACL Inspection via Get-Acl):                            │
 │ Security descriptor lacks read access for non-administrative tokens.    │
 └────────────────────────────────────┬────────────────────────────────────┘
                                      │
                                      ▼
 ┌─────────────────────────────────────────────────────────────────────────┐
 │ ACTION:                                                                 │
 │ Update the registry ACL to grant 'ReadKey' permissions to standard      │
 │ users without granting write access or local administrator rights.      │
 └─────────────────────────────────────────────────────────────────────────┘

ROOT CAUSE

The startup failure was caused by two startup-blocking defects discovered sequentially:

+----------------------------------------------------------------------------------------------------+
|                                    ROOT CAUSE DETERMINATION                                        |
+----------------------------------------------------------------------------------------------------+
| 1. Primary Defect: Misconfigured Registry Access Control List (ACL)                                 |
|    • Resource: HKLM:\SOFTWARE\CorpFinanceTool                                                      |
|    • Condition: Permissions were restricted exclusively to Administrators and SYSTEM.             |
|    • Impact: Standard user tokens received ACCESS DENIED during configuration lookups.            |
|                                                                                                    |
| 2. Secondary Defect: Missing Application Runtime Component                                         |
|    • Resource: C:\Program Files\CorpFinanceTool\bin\CoreNativeEngine.dll                           |
|    • Condition: Required dynamic library was absent from the installation directory.               |
|    • Impact: The bootstrapper detected that the required DLL was absent during pre-flight checks. |
+----------------------------------------------------------------------------------------------------+

REMEDIATION ENGINEERING

Infrastructure & Staging Baseline Setup

To prepare for remote remediation, the staging deployment folder and Group Policy baseline were established.

None None None None None None None None None None

Script Engineering & Idempotency Logic

To ensure production-grade reliability, the remediation script evaluates whether an applicable Allow ACE already provides the required read capability and avoids adding a redundant rule:

  • State Evaluation: Evaluates identity, access rule type (Allow), inheritance, and bitwise/mask rights to ensure ReadKey access is present without making redundant ACL writes.
  • Timestamped Non-Overwriting Backup: Generates an immutable, timestamped ACL backup file (CorpFinanceTool_Acl_Backup_<Timestamp>.xml) only if a backup does not already exist, preserving the true pre-remediation state across repeated executions.
  • Complete State Validation: Evaluates both post-remediation registry ACLs and file presence before returning success.
  • Structured Error Handling: Uses $ErrorActionPreference = "Stop" and try/catch blocks to halt execution immediately on failure.

POWERSHELL AUTOMATION

Script Development

The initial application registry environment and wrapper script were staged, followed by the authoring of Fix-CorpFinanceTool.ps1.

None None None

Script Source Code (Fix-CorpFinanceTool.ps1)

Powershell

<#
.SYNOPSIS
    Automated Endpoint Remediation Script for CorpFinanceTool.
.DESCRIPTION
    Audits/updates registry ACLs on HKLM:\SOFTWARE\CorpFinanceTool, restores
    missing runtime dependencies, and performs post-remediation checks.
#>
[CmdletBinding()]
Param(
    [string]$RegistryPath = "HKLM:\SOFTWARE\CorpFinanceTool",
    [string]$AppBinDir   = "C:\Program Files\CorpFinanceTool\bin",
    [string]$SourceDLL   = "\\DOMAINCON\SoftwareShare\CoreNativeEngine.dll",
    [string]$BackupDir   = "C:\ProgramData\CorpFinanceTool_Backups"
)
$ErrorActionPreference = "Stop"
Write-Host "[*] Starting Endpoint Remediation for CorpFinanceTool..." -ForegroundColor Cyan
try {
    # 1. Audit and Remediate Registry Access Control List (ACL)
    if (Test-Path $RegistryPath) {
        Write-Host "[+] Auditing Registry Permissions on $RegistryPath..." -ForegroundColor Yellow
        $Acl = Get-Acl -Path $RegistryPath
        # Preserve original pre-modification ACL state (Non-Overwriting Timestamped Backup)
        if (-not (Test-Path $BackupDir)) {
            New-Item -Path $BackupDir -ItemType Directory -Force | Out-Null
        }

        $ExistingBackups = Get-ChildItem -Path $BackupDir -Filter "Acl_Backup_*.xml"
        if ($ExistingBackups.Count -eq 0) {
            $Timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
            $AclBackupPath = Join-Path -Path $BackupDir -ChildPath "Acl_Backup_$Timestamp.xml"
            $Acl | Export-Clixml -Path $AclBackupPath -Force
            Write-Host "[+] Pre-modification ACL backed up to $AclBackupPath." -ForegroundColor Gray
        } else {
            Write-Host "[SKIP] Pre-existing baseline ACL backup preserved." -ForegroundColor Gray
        }
        # Evaluate if an applicable Allow ACE already satisfies the ReadKey requirement
        $HasReadKey = $false
        foreach ($Rule in $Acl.Access) {
            if ($Rule.IdentityReference.Value -match "Domain Users" -and
                $Rule.AccessControlType -eq "Allow" -and
                (($Rule.RegistryRights -band [System.Security.AccessControl.RegistryRights]::ReadKey) -eq [System.Security.AccessControl.RegistryRights]::ReadKey)) {
                $HasReadKey = $true
                break
            }
        }
        if (-not $HasReadKey) {
            Write-Host "[+] Applying ReadKey permissions for 'Domain Users'..." -ForegroundColor Yellow
            $Ar = New-Object System.Security.AccessControl.RegistryAccessRule(
                "Domain Users",
                "ReadKey",
                "ContainerInherit, ObjectInherit",
                "None",
                "Allow"
            )
            $Acl.AddAccessRule($Ar)
            Set-Acl -Path $RegistryPath -AclObject $Acl
            Write-Host "[SUCCESS] Registry ACL updated successfully." -ForegroundColor Green
        } else {
            Write-Host "[SKIP] Required registry read permissions already satisfied." -ForegroundColor Gray
        }
    } else {
        throw "Target registry path $RegistryPath does not exist."
    }
    # 2. Remediate Missing Binary Component
    if (-not (Test-Path $AppBinDir)) {
        Write-Host "[+] Creating missing application directory: $AppBinDir..." -ForegroundColor Yellow
        New-Item -Path $AppBinDir -ItemType Directory -Force | Out-Null
    }
    $TargetDLL = Join-Path -Path $AppBinDir -ChildPath "CoreNativeEngine.dll"
    if (-not (Test-Path $TargetDLL)) {
        Write-Host "[+] Restoring missing application dependency from $SourceDLL..." -ForegroundColor Yellow
        if (Test-Path $SourceDLL) {
            Copy-Item -Path $SourceDLL -Destination $TargetDLL -Force
            Write-Host "[SUCCESS] Dependency CoreNativeEngine.dll restored." -ForegroundColor Green
        } else {
            throw "Source dependency $SourceDLL was not found on staging share."
        }
    } else {
        Write-Host "[SKIP] Required application dependency is already present." -ForegroundColor Gray
    }
    # 3. Post-Remediation State Verification
    Write-Host "[+] Performing Post-Remediation Verification..." -ForegroundColor Yellow
    $PostAcl = Get-Acl -Path $RegistryPath

    $ValidAcl = $false
    foreach ($Rule in $PostAcl.Access) {
        if ($Rule.IdentityReference.Value -match "Domain Users" -and
            $Rule.AccessControlType -eq "Allow" -and
            (($Rule.RegistryRights -band [System.Security.AccessControl.RegistryRights]::ReadKey) -eq [System.Security.AccessControl.RegistryRights]::ReadKey)) {
            $ValidAcl = $true
            break
        }
    }

    $ValidFile = Test-Path -LiteralPath $TargetDLL
    if ($ValidAcl -and $ValidFile) {
        Write-Host "[FINAL RESULT] Endpoint remediation completed and verified." -ForegroundColor Green
    } else {
        throw "Post-remediation state verification failed. ACL Valid: $ValidAcl | File Valid: $ValidFile"
    }
} catch {
    Write-Error "[FATAL ERROR] Remediation failed: $($_.Exception.Message)"
    exit 1
}

REMOTE DEPLOYMENT / WINRM

The remediation script was executed remotely from DOMAINCON against CLIENT1 using PowerShell Remoting over WinRM (Invoke-Command):

PS C:\Windows\system32> Invoke-Command -ComputerName "CLIENT1" -FilePath "C:\Users\a-aransiola\Desktop\SoftwareShare\Fix-CorpFinanceTool.ps1"
[*] Starting Endpoint Remediation for CorpFinanceTool...
[+] Auditing Registry Permissions on HKLM:\SOFTWARE\CorpFinanceTool...
[+] Pre-modification ACL backed up to C:\ProgramData\CorpFinanceTool_Backups\Acl_Backup_20260811_044500.xml.
[+] Applying ReadKey permissions for 'Domain Users'...
[SUCCESS] Registry ACL updated successfully.
[+] Restoring missing application dependency from \\DOMAINCON\SoftwareShare\CoreNativeEngine.dll...
[SUCCESS] Dependency CoreNativeEngine.dll restored.
[+] Performing Post-Remediation Verification...
[FINAL RESULT] Endpoint remediation completed and verified.
None

WinRM Transport & Security Context

  • Transport Configuration: WinRM was enabled over default port 5985 (HTTP transport) via GPO (GPO_ENDPOINT_OPERATIONAL_BASELINE).
  • Security Nuance: Opening port 5985 alone does not constitute a complete security boundary. In a domain environment, WinRM can use Kerberos authentication, while the WS-Man/WinRM protocol provides message-level protection. HTTPS provides an additional TLS transport layer and may be preferred where organizational security requirements call for it.

VALIDATION & RESULTS

Validation Matrix

+-----------------------+---------------------------------------------------+------------------------------------+--------+
| Verification Step     | Expected Result                                   | Observed Result                    | Status |
+-----------------------+---------------------------------------------------+------------------------------------+--------+
| Registry Access Check | Standard user can query HKLM:\SOFTWARE\...        | Get-ItemPropertyValue succeeded     | PASS   |
| File Presence Check   | CoreNativeEngine.dll present in bin folder        | Test-Path returned $True           | PASS   |
| Bootstrap Sequence    | Launch.ps1 completes pre-flight checks            | Returned App launched Successfully!| PASS   |
| User Context          | Execution succeeds under mraper token             | Verified under non-admin user      | PASS   |
| Privilege Scope       | User remains in standard Domain Users group       | No local admin elevation required  | PASS   |
+-----------------------+---------------------------------------------------+------------------------------------+--------+

Functional Re-Testing

Resuming the user session on CLIENT1 under standard domain user mraper confirmed successful bootstrap sequence completion:

None None None 
PS C:\Users\mraper> powershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\CorpFinanceTool\Launch.ps1"
Application launched Successfully!

Scope Note: Evidence proves that application startup and bootstrap validation succeeded under the standard-user context. Functional testing of internal application business workflows would occur during post-remediation User Acceptance Testing (UAT).

SECURITY / LEAST PRIVILEGE

+----------------------------------------------------------------------------------------------------+
|                                    LEAST-PRIVILEGE ANALYSIS                                        |
+----------------------------------------------------------------------------------------------------+
| 1. Controlled Scope in Lab Demonstration:                                                          |
|    • Granted 'ReadKey' to 'Domain Users' on HKLM:\SOFTWARE\CorpFinanceTool.                       |
|    • Avoided adding standard users to local 'Administrators' group.                                |
|    • Maintained strict read-only access (preventing registry modification/deletion by users).      |
|                                                                                                    |
| 2. Production Security Scoping Recommendation:                                                     |
|    • While 'Domain Users' provided read-only access in this lab demonstration, production scoping  |
|      should target a dedicated application security group (e.g., 'SG_CorpFinanceTool_Users').     |
|    • Ensures access is restricted exclusively to personnel who require the application.            |
+----------------------------------------------------------------------------------------------------+

PRODUCTION IMPROVEMENTS

To transition this workflow from a demonstrated administrative fix into a production enterprise baseline, the following enhancements should be implemented:

┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│                               PRODUCTION EVOLUTION ROADMAP                                       │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 1. Scoped Security Groups                                                                        │
│    Assign registry read permissions to a dedicated application security group                     │
│    ('SG_CorpFinanceTool_Users') rather than broad 'Domain Users'.                                │
│                                                                                                  │
│ 2. WinRM Transport Hardening & Endpoint Management                                               │
│    Enforce HTTPS (Port 5986) with valid PKI certificates, scope host firewall rules to management│
│    subnets, evaluate Just Enough Administration (JEA), or deploy fixes via Intune / MECM.        │
│                                                                                                  │
│ 3. File Integrity & Package Validation                                                           │
│    Validate dependency binaries using SHA-256 hash checks, Authenticode signature verification,  │
│    or approved package manifests before copying files to endpoint systems.                       │
│                                                                                                  │
│ 4. Exact Rollback via Saved Security Descriptors                                                 │
│    Execute rollback by importing the exact pre-modification ACL XML backup via Import-Clixml     │
│    ($AclBackupPath) rather than attempting manual rule removal.                                  │
└───────────────────────────────────────────────────────────────────────

CONCLUSION

This case study demonstrates a practical approach to enterprise IT support and endpoint administration: reproduce the failure across privilege contexts, gather OS-level diagnostic evidence using tools like ProcMon, isolate sequential defects, apply least-privilege configuration fixes, automate remediation with PowerShell, execute remotely over WinRM, and validate successful recovery from the standard user context.