Here’s a quick write-up of the fundamentals of registry SDDLs that you may find helpful.
Just like files in Windows have Access Control Entries (ACEs), registry keys also can control what users and user groups can create/edit/delete keys. This is done using a Security Description Definition Language (SDDL).
SDDL syntax is a list of ACEs that state what level of access a user/group has for a given key, and whether it is to be inherited by the child keys.
Example: sddl="O:BAG:SYD:PAI(A;CI;KA;;;BA)(A;CI;KR;;;AU)(A;CI;KA;;;LS)(A;CI;KA;;;NS)(A;CI;KR;;;IU)(A;CI;KA;;;SY)"
Let’s break this down.