RegACL regacl.exe allows the System Administrator to grant or revoke rights to Registry hives for some predefinend user groups. Details in german text.