The Windows registry is a central part of the Windows operating system and serves as a database that stores a wide range of system information.

Register contains important information and settings related to the operating system, installed programs, hardware, and user profiles. The registry information is organized into key-value pairs in different sections or 'branches' of the registry.

The registry contains settings and configuration information that control the operation of Windows and installed programs.

The register consists of five main branches called "hives". These are:

Contains information related to file type associations and program associations.

Contains the settings and preferences of the active logged-in user.

Contains system settings and information about all user profiles.

Contains information about hardware configuration.

What is Windows Registry Editor (Regedit)?

, is a built-in tool in the Windows operating system that allows viewing and modifying the Windows registry.

Before modifying the registry, it is important to understand that incorrect changes to the registry can cause serious problems for the system, including system failure. It is recommended to make any changes thoughtfully.

 and can be found, for example, by pressing the Windows key and typing "regedit" into the search.

Navigate in the registry just like in a file system, by clicking on forks to expand them and see their sub-branches and their values.

When you find the desired key, you can edit its values by double-clicking on the value. This opens a window where you can edit the value's data.

It is important to know the value data type (e.g. String, Binary, DWORD) and make the changes accordingly.

You can create a new key by right-clicking on the upper branch and selecting "New" > "Key".

To create a new value, right-click on the key, select "New", and choose the value type.

You can delete the key or value by right-clicking on it and selecting "Delete".

 Before making any changes, it is recommended to take a backup of the registry. This can be done by selecting the key and clicking "File" > "Export". Save the file in a secure location.

 If you encounter any issues, you can restore the registry by clicking "File" > "Import" and selecting the previously created backup file.

The lab takes a couple of minutes to start up, please wait patiently and add more time if needed. You don't need to close the lab between switching modules in this course. You can log in to the server via RDP with the username "

Windows practice

Find the file name of the desktop wallpaper from the registry

In this task, you need to navigate to the Windows registry and find a specific registry value that determines the current desktop background.

Open Windows Registry Editor. You can also do this by pressing Windows + R and typing the command regedit.

 This path contains settings related to the appearance and behavior of your user account's desktop.

. This registry value contains the path to the current desktop wallpaper. Note that if the wallpaper is not defined, the value may be empty or point to the default image.

## What is Windows registry?

The Windows registry is a central part of the Windows operating system and serves as a database that stores a wide range of system information.

Register contains important information and settings related to the operating system, installed programs, hardware, and user profiles. The registry information is organized into key-value pairs in different sections or 'branches' of the registry.

The registry contains settings and configuration information that control the operation of Windows and installed programs.

![](sanity:image-4bcd9700be4a78ca12c817285ab7ed3ee103d600-1174x578-png)

---

## Registry Structure

The register consists of five main branches called "hives". These are:

### **HKEY\_CLASSES\_ROOT (HKCR)**

Contains information related to file type associations and program associations.

### **HKEY\_CURRENT\_USER (HKCU)**

Contains the settings and preferences of the active logged-in user.

### **HKEY\_LOCAL\_MACHINE (HKLM)**

Contains system settings and information about all user profiles.

### **HKEY\_USERS (HKU)**

Contains the settings of all users.

### **HKEY\_CURRENT\_CONFIG (HKCC)**

Contains information about hardware configuration.

---

## What is Windows Registry Editor (Regedit)?

Windows Registry Editor, also known as **regedit**, is a built-in tool in the Windows operating system that allows viewing and modifying the Windows registry.

### Be careful with the registry

Before modifying the registry, it is important to understand that incorrect changes to the registry can cause serious problems for the system, including system failure. It is recommended to make any changes thoughtfully.

### Using the Registry Editor

The registry editor is called **regedit.exe** and can be found, for example, by pressing the Windows key and typing "regedit" into the search.

![](sanity:image-1cf9e1da64548ec93614cf54ffcc8507735aac35-1264x1370-png)

#### Browsing register values

Navigate in the registry just like in a file system, by clicking on forks to expand them and see their sub-branches and their values.

#### Modifying Registry Values:

- When you find the desired key, you can edit its values by double-clicking on the value. This opens a window where you can edit the value's data.
- It is important to know the value data type (e.g. String, Binary, DWORD) and make the changes accordingly.

#### Creating New Keys and Values:

- You can create a new key by right-clicking on the upper branch and selecting "New" > "Key".
- To create a new value, right-click on the key, select "New", and choose the value type.

#### Deleting Keys and Values:

![](sanity:image-3334aa3ecd744e3c6646ab20f6fdb8d19b443c41-732x312-png)

- You can delete the key or value by right-clicking on it and selecting "Delete".

#### 6. Register Backup and Restoration:

![](sanity:image-fd90f85e157ad632ce9e9086a8873d9aeb3b4be8-708x594-png)

- **Backup:** Before making any changes, it is recommended to take a backup of the registry. This can be done by selecting the key and clicking "File" > "Export". Save the file in a secure location.
- **Restore:** If you encounter any issues, you can restore the registry by clicking "File" > "Import" and selecting the previously created backup file.

---

## 
Tasks

@exercise 0d4a6d15962d

### Find the file name of the desktop wallpaper from the registry

In this task, you need to navigate to the Windows registry and find a specific registry value that determines the current desktop background.

- Open Windows Registry Editor. You can also do this by pressing Windows + R and typing the command regedit.
- Navigate to the registry path: **HKEY\_CURRENT\_USER\\Control Panel\\Desktop** This path contains settings related to the appearance and behavior of your user account's desktop.
- Find the key named **Wallpaper**. This registry value contains the path to the current desktop wallpaper. Note that if the wallpaper is not defined, the value may be empty or point to the default image.

@exercise 9f4b4c564355


Registry and Registry Editor (regedit)

In this course, we go through the basics related to managing Windows systems and maintaining information security.

In this course, we will go through the basics of Windows system administration and cybersecurity maintenance.

We familiarize ourselves with Windows virus protection, firewall, and automatic updates. We learn to use remote desktop connections, registry editor, PowerShell, server manager, and group policies.

The course does not go into great depth on Windows domains, attacks on them, or hardening. These more advanced topics are covered in the "Windows - Attack and Defense" course.

Registry and Registry Editor (regedit)

What is Windows registry?

Learn to hack — start here