{"id":110330,"date":"2024-10-01T09:10:22","date_gmt":"2024-10-01T16:10:22","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=110330"},"modified":"2024-10-01T09:10:22","modified_gmt":"2024-10-01T16:10:22","slug":"20241001-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20241001-22\/?p=110330","title":{"rendered":"Misunderstanding the “Prevent access to registry editing tools” policy"},"content":{"rendered":"

There is a group policy called “Prevent access to registry editing tools”. A customer found that even if they enabled the policy, malware was still able to call Reg\u00adSet\u00adValue<\/code> to modify values in the registry. The malware was able to modify the registry even though the policy blocked access to the registry! Is the policy broken?<\/p>\n

Take a closer look at the policy name: “Prevent access to registry editing tools<\/i>.” If you missed it, look at the policy description.<\/p>\n

\n

This setting disables the Windows registry editor or Regedit.exe.<\/p>\n

If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action.<\/p>\n

If you disable this policy setting or do not configure it, users can run Regedit.exe normally.<\/p>\n

To prevent users from using other administrative tools, use the “Run only specified Windows applications” policy setting.<\/p>\n<\/blockquote>\n

What this policy does is prevent tools like regedit.exe<\/tt> and reg.exe<\/tt> from running. Those programs check the policy setting when they start up, and if the policy is set, then they display an error message and exit.<\/p>\n

C:\\> reg.exe query HKLM\\Software\\Microsoft\\Windows\r\nERROR: Registry editing has been disabled by your administrator.\r\n\r\nC:\\> regini.exe\r\nError: Registry editing has been disabled by your administrator.\r\n<\/pre>\n\n\n\n
\n
Registry Editor<\/div>\n
\u24e7 Registry editing has been disabled by your administrator.<\/div>\n
\n
OK<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The policy has no effect on other programs. They are still allowed to access the registry, subject to the normal rules.<\/p>\n
In other words, this is not “prevent access to the registry”. It’s “prevent access to registry editing tools.”<\/p>\n
After all, if this policy prevented anybody from accessing the registry, then a lot of things would stop working. For one thing, Windows keeps some of its own configuration data in the registry, so blocking access to the registry would prevent Windows from knowing, say, which drivers to load.<\/p>\n
Bonus chatter<\/b>: Since the policy check is performed voluntarily from reg.exe<\/tt> and regedit.exe<\/tt>, a dedicated end user could look for other ways to perform registry modifications, such as PowerShell scripting or downloading their own alternate registry editing tool. This policy is intended to block casual users from messing up their own machines. It is not a security boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
It prevents access to the tools, but not to the registry itself.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[104],"class_list":["post-110330","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-tipssupport"],"acf":[],"blog_post_summary":"
It prevents access to the tools, but not to the registry itself.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/110330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=110330"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/110330\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=110330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=110330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=110330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}