PowerShell/PowerShell · error · NotImplementedException

SetAccessControl(ObjectSecurity securityDescriptor) is not i

Error message

SetAccessControl(ObjectSecurity securityDescriptor) is not implemented. TransactedRegistry related APIs should not be used.

What it means

TransactedRegistryKey.SetAccessControl is a CoreCLR stub. Applying ACLs through the transacted registry is unsupported on PowerShell 7+, so the method throws NotImplementedException.

Source

Thrown at src/System.Management.Automation/CoreCLR/CorePsStub.cs:211

        }

        public RegistryValueKind GetValueKind(string name)
        {
            throw new NotImplementedException("GetValueKind(string name) is not implemented. TransactedRegistry related APIs should not be used.");
        }

        public void Close()
        {
            throw new NotImplementedException("Close() is not implemented. TransactedRegistry related APIs should not be used.");
        }

        public abstract string Name { get; }

        public abstract int SubKeyCount { get; }

        public void SetAccessControl(ObjectSecurity securityDescriptor)
        {
            throw new NotImplementedException("SetAccessControl(ObjectSecurity securityDescriptor) is not implemented. TransactedRegistry related APIs should not be used.");
        }

        public ObjectSecurity GetAccessControl(AccessControlSections includeSections)
        {
            throw new NotImplementedException("GetAccessControl(AccessControlSections includeSections) is not implemented. TransactedRegistry related APIs should not be used.");
        }
    }

    internal sealed class TransactedRegistry
    {
        internal static readonly TransactedRegistryKey LocalMachine;
        internal static readonly TransactedRegistryKey ClassesRoot;
        internal static readonly TransactedRegistryKey Users;
        internal static readonly TransactedRegistryKey CurrentConfig;
        internal static readonly TransactedRegistryKey CurrentUser;
    }

    internal sealed class TransactedRegistrySecurity : ObjectSecurity

View on GitHub (pinned to 3ff3c711bf)

Solutions

Apply the ACL with RegistryKey.SetAccessControl (Microsoft.Win32.Registry) outside a transaction.
Use Set-Acl / Get-Acl on the HK: drive without -UseTransaction.
Guard with Platform.IsWindows and never use the transacted overload on CoreCLR.

Example fix

// before
TransactedRegistry.LocalMachine.SetAccessControl(sd);
// after
using RegistryKey key = Registry.LocalMachine;
key.SetAccessControl((RegistrySecurity)sd);

Defensive patterns

Strategy: validation

Validate before calling

if (!System.Management.Automation.Platform.IsWindows) {
    throw new PlatformNotSupportedException("TransactedRegistry is unsupported; use Microsoft.Win32.RegistryKey.SetAccessControl().");
}

Type guard

static bool IsTransactedRegistrySupported => false;

Try / catch

try { TransactedRegistry.LocalMachine.SetAccessControl(sd); }
catch (NotImplementedException) {
    using var key = Registry.LocalMachine;
    key.SetAccessControl((RegistrySecurity)sd);
}

Prevention

Apply ACLs via RegistryKey.SetAccessControl / Set-Acl (no -UseTransaction).
Audit security-management modules for transactional registry use.
Keep ACL operations outside Start-Transaction scopes.

When it happens

Trigger: Calling TransactedRegistryKey.SetAccessControl(securityDescriptor) on CoreCLR, typically via legacy transaction-scoped ACL code.

Common situations: Module ported from Windows PowerShell that set registry ACLs inside Start-Transaction; code reaching the internal TransactedRegistryKey type.

Related errors

AI-assisted analysis of PowerShell/PowerShell@3ff3c711bf (2026-08-13). Data as JSON: /api/errors/ade06c66e0451d1a. Report an issue: GitHub.