Windows stores a large amount of configuration information.
Examples include:
- Installed Software
- User Preferences
- Service Configuration
- Network Settings
- Security Configuration
- Application Settings
This information is commonly stored within the Windows Registry.
Why This Matters
Many Windows components depend on the Registry.
Examples include:
| Component | Registry Usage |
|---|---|
| Applications | Configuration |
| Services | Startup Configuration |
| Windows | System Settings |
| Users | Personal Preferences |
| Security Features | Security Configuration |
What Is The Registry?
The Registry is a hierarchical database used by Windows to store configuration information.
Conceptually:
Windows
↓
Reads Registry
↓
Obtains Configuration
Examples:
Wallpaper Settings
Service Configuration
Installed Applications
Many Windows components read Registry information during startup and operation.
Registry Structure
The Registry is organized as a hierarchy.
Conceptually:
Registry
├── Key
│ ├── Subkey
│ └── Value
This structure resembles directories and files within a file system.
Example:
Registry
↓
Key
↓
Subkey
↓
Value
Registry Hives
The top-level sections of the Registry are known as:
Hives
Common examples include:
| Hive | Purpose |
|---|---|
| HKEY_LOCAL_MACHINE (HKLM) | System-wide configuration |
| HKEY_CURRENT_USER (HKCU) | Current user settings |
| HKEY_USERS (HKU) | User profiles |
| HKEY_CLASSES_ROOT (HKCR) | File associations |
| HKEY_CURRENT_CONFIG (HKCC) | Hardware configuration |
Operators frequently encounter HKLM and HKCU.
Registry Keys
Keys are similar to directories.
Example:
HKLM
└── SOFTWARE
A key may contain:
- Additional keys
- Values
Conceptually:
Key
↓
Contains
↓
Subkeys + Values
Registry Values
Values contain the actual configuration data.
Example:
Wallpaper = wallpaper.jpg
Conceptually:
Registry Key
↓
Value Name
↓
Value Data
Examples:
InstallPath = C:\Program Files\App
Start = 2
Viewing The Registry
Registry Editor:
regedit.exe
Conceptually:
Registry
↓
Regedit
↓
Browse Configuration
Command Line Access
Command Prompt:
reg query HKLM\SOFTWARE
PowerShell:
Get-ItemProperty HKLM:\SOFTWARE
The Registry can be queried and modified from the command line.
User Configuration
User-specific settings commonly reside within:
HKCU
Examples include:
- Desktop Settings
- Application Preferences
- Environment Configuration
Conceptually:
Alice Logs In
↓
HKCU Maps To
↓
Alice's Settings
Different users may therefore have different configurations.
System Configuration
System-wide settings commonly reside within:
HKLM
Examples include:
- Installed Software
- Drivers
- Services
- Security Settings
Changes to HKLM frequently affect all users of the system.
Services and the Registry
Windows services are heavily configured through the Registry.
Examples include:
- Service Startup Type
- Service Account
- Service Path
Conceptually:
Service
↓
Reads Registry
↓
Obtains Configuration
Many service investigations eventually involve Registry analysis.
Startup Locations
The Registry contains locations commonly used for automatic execution.
Examples include:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Programs configured here may automatically launch during logon.
These locations are frequently examined during investigations.
Security Considerations
The Registry is a common location for:
- Persistence
- Configuration Abuse
- Malware Storage
- Security Configuration
Questions operators commonly ask include:
- What changed?
- What executes automatically?
- What software was installed?
- What configuration appears unusual?
Registry analysis is often a key part of investigations.
Operator Perspective
When approaching an unfamiliar Windows system, Operators typically ask:
Configuration
- What settings are configured?
- What software is installed?
Users
- What user settings exist?
- Which users have logged on?
Services
- How are services configured?
- Which services start automatically?
Persistence
- What executes during startup?
- Are unusual Registry entries present?
Security
- Has malware modified the Registry?
- Have security settings changed?
- Have persistence mechanisms been added?
Many investigations eventually involve Registry analysis.
Key Takeaways
- The Registry is a hierarchical configuration database.
- Windows relies heavily on Registry information.
- Registry information is organized into hives, keys, and values.
- HKLM commonly stores system-wide settings.
- HKCU commonly stores user-specific settings.
- The Registry can be viewed using Regedit.
- Services frequently store configuration in the Registry.
- Startup locations often exist within the Registry.
- The Registry is a common location for persistence mechanisms.
- Understanding the Registry is essential for both offensive and defensive operations.
The next lesson explores Telemetry and how Windows records system activity.