Reg symlink aren't a good deal, I checked the api it seem's nice to prevent abusement. You need to impersonate the user in order to get a valid path to the user registry hive, I tried to link between users hive (the user and the system hive in HKEY_USERS)
List 4- that is in bounty scope and not current mitigated( like symlink unpriv hive -> priv hive )
-
-
This Tweet is unavailable.
-
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.