www.BlackViper.com: Windows 7 Services 411 - Remote Registry

Remote Registry

Default Description:

Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.

Additional Information:

This is one of those not needed services. One of the first I disable. If you are paranoid about security, disable this service. Even if you are not or do not care, disable it anyway.

Additional Reading:

• None at this time.

Discussion Topic Link:

Windows 7 Services Forum

Defaults Startup Type:

Windows 7 Starter: Manual
Windows 7 Home Basic: Manual
Windows 7 Home Premium: Manual
Windows 7 Professional: Manual
Windows 7 Ultimate: Manual
Windows 7 Enterprise: Manual

Other Settings:

Safe Setting: Disabled *

Service Names:

Service Name (registry): RemoteRegistry

Display Name: Remote Registry

Default Path and Command Line Options:

C:\Windows\system32\svchost.exe -k regsvc

Log On As:

Account: Local Service

Dependencies:

What service Remote Registry needs to function properly:

• Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
  • DCOM Server Process Launcher (S, HB, HP, P, U, E)
  • RPC Endpoint mapper (S, HB, HP, P, U, E)

What other service require Remote Registry to function properly:

• None (S, HB, HP, P, U, E)

Registry Settings (.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RemoteRegistry]
"DisplayName"="@regsvc.dll,-1"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,72,00,65,00,67,00,73,00,76,00,63,00,00,00
"Description"="@regsvc.dll,-2"
"ObjectName"="NT AUTHORITY\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\
00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RemoteRegistry\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
72,00,65,00,67,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00