DSC Registry Resource access rights for Subkeys get shadowed

[Malte-sudo]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Summary

The Appx Registry Key is owned bei "TrustedInstaller", which has Full Control over Appx Key.
"SYSTEM" and "Administrators" have special Permissions for Appx Key itself:
They can't Delete, Write DAC or Write Owner, but they have Full Control for Subkeys.
An Administrator can't delete Subkeys with DSC3, but can delete manualy with Registry Editor.

Steps to reproduce

1. Save this Config
   {
   "$schema": "https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/v3/bundled/config/document.vscode.json",
   "resources": [
   {
   "name": "Appx Up",
   "type": "Microsoft.Windows/Registry",
   "properties": {
   "keyPath": "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx",
   "valueName": "Example",
   "_exist": true,
   "valueData": {
   "String": "this does work"
   }
   }
   },
   {
   "name": "Appx down",
   "type": "Microsoft.Windows/Registry",
   "properties": {
   "keyPath": "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx",
   "valueName": "Example",
   "_exist": false
   }
   }
   ]
   }

2. As Administrater: dsc config set -f

3. Check Key Path in Registry Editor

Expected behavior

dsc config set -f <name of config>
<key gets established and deleted>

Actual behavior

dsc config set -f <name of config>
ERROR trace_message="PID 9520: Registry key: Permission denied for given path: \"Software\\\\Policies\\\\Microsoft\\\\Windows\\\\Appx\""
ERROR Error: Command: Resource 'registry' [exit code 3] manifest description: Registry error

Error details

Environment data

Name                           Value
----                           -----
PSVersion                      7.5.3
PSEdition                      Core
GitCommitId                    7.5.3
OS                             Microsoft Windows 10.0.19045
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Version

3.1.0

Visuals

No response

[Gijsreyn]

Nice catch @Malte-sudo - I've just hit up a pull request and validated it locally.