Okay I understand what you're asking now. You want to place a restriction on the registry. So machines can access the registry but not make changes to any of it.
The answer is... there aren't specific options in the Registry access control rule to distinguish between changes, creates, deletes, and reads. The rule is simply there to protect a registry set from overall change. However, you can still accomplish what you're asking, by simply creating a rule with a Deny action for whatever your target set is. But keep in mind - the registry is used for some pretty weird stuff. For example I've seen backup software use the registry to store temp values during a backup. If you deny that write action, the backup software wouldn't work.
In your first post you asked about the Machine keys on a domain controller. If you stopped writes to this (made it Read Only) the DC would not function.
My personal preference is not to go overboard with registry access control rules. I started off monitoring the 4 main hives. It wasn't useful information, just a lot of white noise. So now I'm targetting very specific keys I know I don't want written to. Some of my rules include watching the Run keys and BHO keys. I could also get really locked down by restricting All Applications from writing to particular Software keys, except for the Software that owns the keys.
