1

This question is with regards to Windows Personal PC.

How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices are required:

  • Use non-admin account when possible
  • Keep OS version up-to-date
  • Keep malware and virus checker up-to-date
  • Know the source of .exe and .bat files I install and run and ensure they are safe
  • Know which sites I visit and ensure they are safe

but I guess this is still not enough since some malware can defeat the above and end-up changing the Registry information, so my questions are:

Q1: How can I guarantee that the registry will not be tampered with?

Q2: Could a non-admin account change the registry?

Q3: Does windows report such changes in a log? How to access that log?

Thx.

  • 2
    The registry has shared parts which can only be changed by an admin, and per-user parts which can be changed by unprivileged applications of that user. – CodesInChaos Jan 24 '16 at 10:38
  • 1
    There is no way to guarantee it will not be tampered with. You can awnser q2 yourself without too much effort. I.e Make a non admin account and attempt to open regedit. For q3 have a look here; stackoverflow.com/questions/144468/… – TheJulyPlot Jan 24 '16 at 18:53
1

In very simple words, Windows Registry is used by other applications to store user/system specfic data to be used by application.

Q1&Q2(Answered together): Unless you are continuously monitoring your system, there is not practical way to determin if your programs has made registry changes. You can specifically use tools like procmon, regmon to monitor a specific app. Secondly, if you are a non-admin you should always be allowed to change HKCU registry, because legit programs will also use registry keys under that hive. Theoritically , if you are concerned about any registry key in particular you can always allow or deny permission using ACL.

To explain with an example: If a software/malware want to maintain persistance by launching at every user logon, it might add entry into the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to launch itself. Click here for more info ! However, hypothetically you can set permission for a particular key and then deny the non-admin user the permission for the key. For the above example , this image will provide a better clarity Screenshot

Q3. Various methods like WMI notification, Event viewer for monitoring all the time. Procmon and regedit can by used to monitor registry changes over a specific period of time.

  • Thank you for your detailed answer. – NoChance May 8 at 9:49
1

You might want to install a Host-based Intrusion Prevention System (HIPS), create a correlation that matches your desire and block the action and also provide an alert/notification about the activity. But this might be an administrative burden as you have to always monitor for false positives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.