You can’t. Not programatically, and not thru the GUI. Why? Because the registry, created 20 years ago, sets security descriptors only on keys, not on values.
The problem is that the GUI appears to permit this. Here is an example. I am trying to permit users to set the HKLM\SYSTEM\CurrentControlSet\Control\Lsa FipsAlgorithmPolicy value. This is the view after clicking the Advanced setting.
I click Add, and grant Set Value permissions to local users. The GUI now shows:
The problem is that although it appears that I have set permissions on a single value, here FipsAlgorithmPolicy, I have really set it on the entire Key. Here is a screen shot of the permissions on restrictanonymous under the same LSA key:
This is not what I expected to see! You appear to be able to set the permissions on a single value, but the GUI is instead changing the value for the entire key.
A similar thing happens within the Group Policy Management MMC. You appear to be able to set security from within the Group Policy Management editor. However, instead of setting permissions on the key, when the GPO is applied the permission change fails.
Thanks to PSS engineer David Branch at Microsoft for his help with this issue. Expect a TechNet article on the issue in January.