server: Avoid unloading of HKU .Default registry branch.

dlls/advapi32/tests/registry.c

@@ -1598,6 +1598,14 @@ static void test_reg_unload_key(void)
     ret = RegUnLoadKeyA(HKEY_LOCAL_MACHINE, "Test");
     ok(ret == ERROR_SUCCESS, "expected ERROR_SUCCESS, got %ld\n", ret);
 
+    pRtlInitUnicodeString(&key_name, L"\\REGISTRY\\User\\.Default");
+    InitializeObjectAttributes(&attr, &key_name, OBJ_CASE_INSENSITIVE, NULL, NULL);
+    status = pNtUnloadKey(&attr);
+    ok(status == STATUS_ACCESS_DENIED, "expected STATUS_ACCESS_DENIED, got %08lx\n", status);
+
+    ret = RegUnLoadKeyA(HKEY_USERS, ".Default");
+    ok(ret == ERROR_ACCESS_DENIED, "expected ERROR_ACCESS_DENIED, got %ld\n", ret);
+
     set_privileges(SE_RESTORE_NAME, FALSE);
 
     DeleteFileA("saved_key");

server/registry.c

@@ -2357,6 +2357,8 @@ DECL_HANDLER(unload_registry)
     {
         if (key->obj.handle_count)
             set_error( STATUS_CANNOT_DELETE );
+        else if (key->obj.is_permanent)
+            set_error( STATUS_ACCESS_DENIED );
         else
             delete_key( key, 1 );     /* FIXME */
         release_object( key );