hi, what do people do to lock down hklm\software after the pc has been in use for a long time? the nsa guidelines say to give everyone read on hklm\software, but does not specify recursing down. however, once software has been loaded the cow is out of the barn. for example: Software\Adobe\Acrobat Reader\5.0 Owner: Administrators (lg) Administrators (lg) (Full)*1 CREATOR OWNER ()*(Full) Everyone (QWCENDR)*1 SYSTEM (Full)*1 should i recurse down hklm\software and set all entries for everyone to 'read'? thanks.