Well, we might be closer to figuring out what is screwing up the registry permissions in a lot of our packages. From what we have seen so far, RegPerm must have a few bugs. It is shutting off inheritence on keys that it isn't supposed to and replacing the existing permissions with the new ones you are adding instead of just doing an edit on the existing ACL. Someone found this article and it looks like others have run into similar problems as well.

I've always used SetACL to set permissions. The syntax takes a bit of learning but the thing just flat-out works.

Hopefully we can transition to SetACL and stop breaking critical system components whenever we send out a package that sets registry permissions.

I still need to get our packagers to stop granting all users Full Control at high levels in the registry like HKEY_CLASSES_ROOT and HKLM\Software. It can be a real pain to get apps to work in a locked-down environment but you always end up paying whenever you take the easy way out.