注冊表常用鍵值設(shè)置詳解

1、組策略中常用項(xiàng)解析刪除運(yùn)行命令HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nPoliciesExplorerNoRun*隱藏/顯示文件夾選項(xiàng)*SoftwareMicrosoftWi ndowsCurre ntV ersio nPoliciesExplorerNoFolderOptio ns*ersio nPoliciesExplorerNoFi刪除查找命令HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV nd從開始菜單的屬性中刪除任務(wù)欄HKEY_CURRENT_USERS

2、oftwareMicrosoftWi ndowsCurre ntV tTaskbar我的電腦中隱藏驅(qū)動(dòng)器HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ives退出時(shí)不保存設(shè)置HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ose只能允許運(yùn)行的 Windows程序HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ctRun*禁用密碼的用戶配置文件頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndows

3、Curre ntV ilePage*禁止系統(tǒng)鼠標(biāo)右擊快捷菜單ersio nPoliciesExplorerNoSeersio nPoliciesExplorerNoDrersio nPoliciesExplorerNoCIersio nPoliciesExplorerRestriersio nPoliciesSystemNoProfHKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ewCo ntextMe nu*禁止任務(wù)欄鼠標(biāo)右擊快捷菜單ersionPoliciesExplorerNoV iHKEY_CURRENT_USERSoftware

4、MicrosoftWi ndowsCurre ntV ayCo ntextMe nu*禁止修改開始按鈕快捷菜單ersio nPoliciesExplorerNoTrHKEY_USERS.DEFAULTSoftwareMicrosoftWi ndowsCurre ntV han geStartMe nu*禁用顯示器”控制面板e(cuò)rsio nPoliciesExplorerNoCHKEY_USERS.DEFAULTSoftwareMicrosoftWi ndowsCurre ntV pCPL*隱藏背景頁ersio nPoliciesSystemNoDisHKEY_CURRENT_USERSoftwa

5、reMicrosoftWi ndowsCurre ntV pBackgro un dPage*隱藏屏幕保護(hù)程序頁ersio nPoliciesSystemNoDisHKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nPoliciesSystemNoDispScrSavPage*ersio nPoliciesSystemNoDis隱藏外觀頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV pAppeara ncePage*隱藏設(shè)置頁HKEY_CURRENT_USERSoftwar

6、eMicrosoftWi ndowsCurre ntV pAppeara ncePage*禁用網(wǎng)絡(luò)”控制面板HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV tSetup*隱藏標(biāo)識(shí)頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV tSetuplDPage*隱藏訪問控制頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV tSetupSecurityPage*隱藏口令”控制面板HKEY_CURRENT_USERSoftwareMicro

7、softWi ndowsCurre ntV tSetupSecurityPage*隱藏更改口令頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV wdPage*隱藏遠(yuǎn)程管理頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV mi nPage*隱藏用戶配置文件頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ofilePage*隱藏常規(guī)和詳細(xì)資料頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCu

8、rre ntV n terTabs*禁止刪除打印機(jī)HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV letePri nter*禁止添加打印機(jī)HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV dPrin ter*隱藏設(shè)備管理頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVMgrPage*隱藏硬件配置文件頁HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV figPage*隱藏文件系統(tǒng)

9、”按鈕ersio nPoliciesSystemNoDisersio nPoliciesNetworkNoNeersio nPoliciesNetworkNoNeersio nPoliciesNetworkNoNeersio nPoliciesNetworkNoNeersio nPoliciesNetworkNoPersio nPoliciesNetworkNoAdersio nPoliciesNetworkNoPrersio nPoliciesExplorerNoPriersio nPoliciesExplorerNoDeersio nPoliciesExplorerNoAdersio nP

10、oliciesSystemNoDeversio nPoliciesSystemNoC onHKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nPoliciesSystemNoFileersio nPoliciesSystemNoVirtersio nPoliciesNetworkNoFilersio nPoliciesNetworkNoPriersio nPoliciesExplorerNoStaersio nPoliciesExplorerNoRuersio nPoliciesExplorerNoSeersio nPolicie

11、sExplorerNoFiersio nPoliciesExplorerNoDrersio nPoliciesExplorerNoNeersio nPoliciesNetworkNoE nersio nPoliciesNetworkNoWersio nPoliciesExplorerNoDeersio nPoliciesExplorerNoCIersio nPoliciesExplorerNoCISysPage*隱藏虛擬內(nèi)存”按鈕HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV MemPage*禁用文件共享控制HKEY_CURRENT_US

12、ERSoftwareMicrosoftWi ndowsCurre ntV eShari ngCo ntrol*禁用打印共享控制HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ntShari ngCo ntrol*隱藏開始菜單HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV rtMe nuSubFolders*刪除運(yùn)行命令HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVn*從開始菜單上的設(shè)置中刪除文件夾HKEY_CURRENT_USE

13、RSoftwareMicrosoftWi ndowsCurre ntV tFolders*刪除查找命令HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVnd*在我的電腦中隱藏驅(qū)動(dòng)器HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ives*隱藏網(wǎng)上鄰居HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV tHood*網(wǎng)上鄰居中沒有整個(gè)網(wǎng)絡(luò)”HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV

14、 tireNetwork*網(wǎng)上鄰居中沒有工作組目錄HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV orkgroupC ontents*隱藏桌面上的所有程序項(xiàng)HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV sktop*禁用關(guān)閉系統(tǒng)”命令HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVose*退出時(shí)不保存設(shè)置HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVose*禁用注冊表編輯器H

15、KEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV eRegistryTools*ersio nPoliciesExplorerRestri只能允許運(yùn)行的 windows程序HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV ctRun*禁止光盤自動(dòng)運(yùn)行HKEY_USERS.DEFAULTSoftwareMicrosoftWi ndowsCurre ntV riveTypeAutoR un*每次退出系統(tǒng)（或注銷用戶）時(shí)自動(dòng)清除文檔歷史記錄HKEY_USERS.DEFAULTSoftwareMi

16、crosoftWi ndowsCurre ntV Rece ntDocs On Exit關(guān)閉,開始？菜單動(dòng)畫提示HKEY_USERS.DEFAULTSoftwareMicrosoftWi ndowsCurre ntV artBa nn er*ersio nPoliciesExplorerNoDersio nPoliciesExplorerClearersio nPoliciesExplorerNoSt瀏覽器設(shè)置自定義IE的臨時(shí)目錄HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nExplorerUserShell Folders

17、Cache*自定義CookiesHKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nExplorerUserShell FoldersCookies*自定義收藏夾”HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nExplorerUserShell FoldersFavorites*自定義歷史記錄”HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVersio nExplorerUserShell FoldersHi

18、story*指定瀏覽器（包括ie瀏覽器、windows的explorer瀏覽器）工具欄的背景HKEY_CURRENT_USERSoftwareMicrosoftI nternet ExplorerToolbarBackBitm ap*設(shè)置ie標(biāo)題欄HKEY_CURRENT_USERSoftwareMicrosoftI nternet ExplorerMai nWin dow Title* 不檢查ie更新HKEY_CURRENT_USERSoftwareMicrosoftI nternet ExplorerMai nNoUpdateCheck*禁用常規(guī)頁HKEY_CURRENT_USERSoft

19、warePoliciesMicrosoftI nternetExplorerCo ntrol Pan elNoGe neralTab*禁用更改主頁設(shè)置HKEY_CURRENT_USERSoftwarePoliciesMicrosoftl nternetExplorerC on trol Pan elHomePage*禁用更改輔助功能設(shè)置HKEY_CURRENT_USERSoftwarePoliciesMicrosoftl nternetExplorerC on trol Pan elAccessibility*In ternet Explorer-IIS 安全通道設(shè)置*SYSTEM*C on

20、trolSet*C on trolSecurityProvidersSCHANNELProtocols*資源管理器設(shè)置右對(duì)齊菜單HKEY_CURRENT_USERC on trol Pan elDesktopMe nuDropAlig nment*隱藏/顯示隱藏文件：*SoftwareMicrosoftWi ndowsCurre ntV *SoftwareMicrosoftWi ndowsCurre ntV *SoftwareMicrosoftWi ndowsCurre ntV 隱藏/顯示開始菜單運(yùn)行項(xiàng)*SoftwareMicrosoftWi ndowsCurre ntV 桌面墻紙?jiān)O(shè)置ersi

21、o nExplorerAdva ncedShowSuperHidde n*ersio nExplorerAdva ncedSuperHidde n*ersio nExplorerAdva ncedHidde n*ersio nExplorerAdva ncedStartMe nuRun*l nternet ExplorerDesktopGe neralWallpaper*lnternet ExplorerDesktopGe neralBackupWallpaper* *lnternet ExplorerDesktopGe neralWallpaperFileTime*l nternet Exp

22、lorerDesktopGe neralTileWallpaper*lnternet ExplorerDesktopGe neralC on vertedWallpaper* *lnternet ExplorerDesktopGe neralOrigi nalWallpaper*l nternet ExplorerDesktopGe neralWallpaperStyle*Co ntrol Pa nelDesktopWallpaper*Co ntrol Pa nelDesktopBackWallpaper*Co ntrol Pan elDesktopOrigi nalWallpaper*C o

23、n trol Pan elDesktopCo nvertedWallpaper*C on trol Pan elDesktopTileWallpaper*C on trol Pa nelDesktopWallpaperStyle*在新建快捷方式時(shí)不顯示快捷方式字符串ersio nExplorerLi nk*ersio nExplorerUserersio nExplorerUserHKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV 自定義程序”文件夾HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre

24、 ntV Shell FoldersPrograms*自定義桌面圖標(biāo)HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV Shell FoldersDesktop*自定義啟動(dòng)文件夾HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVShell FoldersStartup*自定義網(wǎng)上鄰居HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV Shell FoldersNetHood*自定義開始菜單HKEY_CURRENT_USERSoftwareM

25、icrosoftWi ndowsCurre ntV Shell FoldersStart Menu*自定義開始菜單中的文檔HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntV Shell FoldersRece nt*自定義我的文檔文件夾HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre ntVShell FoldersPerso nal*開始菜單速度ersio nExplorerUserersio nExplorerUserersio nExplorerUserersio nExplorerUser

26、ersio nExplorerUserHKEY_USERS.DEFAULTC on trol Pa nelDesktopMe nuShowDelay*開始菜單速度HKEY_LOCAL_MACHINESoftwareCLASSESCLSID00021400-0000-0000-C000-000000000046Me nu ShowDelay*關(guān)閉菜單動(dòng)畫效果HKEY_USERS.DEFAULTC on trol Pan elDesktopWi ndowMetricsMi nAn imate*關(guān)閉平滑卷動(dòng)效果HKEY_USERS.DEFAULTC on trol Pa nelDesktopSmoo

27、thScroll*關(guān)閉動(dòng)畫顯示窗口、菜單和列表HKEY_USERS.DEFAULTC on trol Pan elDesktopUserPrefere ncemask*系統(tǒng)托盤顯示時(shí)間前面加一字符串HKEY_CURRENT_USERC on trol Pan elI nternatio nalStimeFormat* 系統(tǒng)自動(dòng)記錄文件夾視圖設(shè)置的數(shù)量上限*SoftwareMicrosoftWi ndowsShellBagMRU Size*SoftwareMicrosoftWi ndowsShellNoRoamBagMRU Size*新建菜單項(xiàng)*ShellExCo ntextMe nuHa nd

28、lers*屏幕保護(hù)程序設(shè)置HKCUC on trol Pan elDesktopScree nSaveActive*HKCUC on trol Pa nelDesktopScree nSavelsSecure*HKCUControl PanelDesktopSCANSA VE.EXE*局域網(wǎng)共享文件設(shè)置 *SoftwareMicrosoftWi ndowsCurre ntV ersio nExplorerWorkgroupCrawlerSharesShared*系統(tǒng)設(shè)置自定義windows臨時(shí)文件夾HKEY_CURRENT_USERSoftwareMicrosoftWi ndowsCurre

29、ntVersio nExplorerUserShell FoldersTemplates*不自動(dòng)搜索網(wǎng)絡(luò)文件夾和打印機(jī)*SoftwareMicrosoftWi ndowsCurre ntV ersio nExplorerAdva ncedNoNetCrawli ng*出錯(cuò)時(shí)報(bào)警HKEY_CURRENT_USERC on trol Pan elSou ndBeep*不顯示最后登錄的用戶名HKEY_LOCAL_MACHINESoftwareMicrosoftWi ndowsCurre ntVersio nWinl ogo nDon tDisplayLastUserName*允許登錄前關(guān)機(jī)HKEY_

30、LOCAL_MACHINESoftwareMicrosoftWi ndowsCurre ntVersio nWinl ogo nShutdow nWithoutLogo n*縮短ctrl+alt+del關(guān)閉無響應(yīng)程序的等待時(shí)間(ms)HKEY_USERS.DEFAULTC on trol Pan elDesktopWaitToKillAppTimeout*縮短應(yīng)用程序出錯(cuò)的等待響應(yīng)時(shí)間(ms)HKEY_USERS.DEFAULTC on trol Pa nelDesktopH un gAppTimeout*Explorer崩潰之后，Windows自動(dòng)恢復(fù)桌面HKEY_LOCAL_MACHINE

31、SoftwareMicrosoftWi ndowsCurre ntVersio nWin logo nAutoRestartShell*文件系統(tǒng)底層設(shè)置 底層項(xiàng)HKLMSYSTEM*C on trolSet*C on trolFileSystem*Windows系統(tǒng)文件存儲(chǔ)位置/備份設(shè)置 重要項(xiàng)HKLMSYSTEM*Co ntrolSet*C on trolBackupRestore*系統(tǒng)定時(shí)運(yùn)行任務(wù)設(shè)置 可以通過此鍵定時(shí)運(yùn)行程序*SYSTEM*C on trolSet*ServicesSchedule*VB/VBA程序設(shè)置/調(diào)試內(nèi)容HKCRSoftwareVB and VBA Program

32、 Setti ngs*In ternet Explorer加載DLL位置1 nternet Explorer加載DLL讀取位置，有惡意程序會(huì)通過此處 在In ternet Explorer加載時(shí)加載/復(fù)活*SOFTW AREMicrosoftWindowsCurrentV ersionExplorerShelllconOverlayIdentifiers*ini文件注冊表映射HKLMSOFTWAREMicrosoftWi ndows NTCurre ntVersio nln iFileMappi ng*MountPoint項(xiàng)Autorun.inf文件內(nèi)容注冊表存儲(chǔ)位置,U盤自動(dòng)運(yùn)行類病毒重點(diǎn)防

33、御部位*SoftwareMicrosoftWi ndowsCurre ntV ersio nExplorerMou ntPoi nts2*Windows程序路徑 包含了常用程序的路徑記錄，謹(jǐn)防病毒惡意修改為病毒路徑，個(gè)人認(rèn)為全局允許配合記錄日志，然后定期查看比較合適 ？還是直接套用詢問的好 ？HKLMSOFTWAREMicrosoftWi ndowsCurre ntVersio nApp Paths*URL默認(rèn)前綴 部分病毒會(huì)修改這里的DefaultPrefixdefault,這里一般直接禁寫吧 HKLMSOFTWAREMicrosoftWi ndowsCurre ntVersio nURL*

34、Svchost程序配置 此注冊表項(xiàng)下的每個(gè)值都代表單獨(dú)的Svchost組，包含Svchost加載項(xiàng)，微軟官方解釋請(qǐng)移步： > ;HKLMSOFTWAREMicrosoftWi ndows NTCurre ntVersio nSvcHost*系統(tǒng)文件檢查器參數(shù)ersio nWinl ogo nSFCDisable*ersio nWinl ogo nSFCSca n* ersio nWinl ogo nSFCQuota*SOFTW AREMicrosoftWi ndows NTCurre ntV *SOFTW AREMicrosoftWi ndows NTCurre ntV*SOFTW ARE

35、MicrosoftWi ndows NTCurre ntV 命令提示符配置參數(shù)*SoftwareMicrosoftComma nd Processor*惡意程序會(huì)利用下面鍵值在命令提示符運(yùn)行前啟用其它應(yīng)用程序*SoftwareMicrosoftComma nd ProcessorAutoRu n*命令擴(kuò)展開關(guān)*SoftwareMicrosoftComma nd ProcessorE nableExte nsions* 我的電腦配置參數(shù)備份程序路徑儲(chǔ)存鍵：HKLMSOFTWAREMicrosoftWi ndowsCurre ntV 磁盤清理程序儲(chǔ)存鍵：HKLMSOFTWAREMicrosoftW

36、i ndowsCurre ntV 磁盤整理程序儲(chǔ)存鍵：HKLMSOFTWAREMicrosoftWi ndowsCurre ntV輔助工具配置參數(shù)ersionExplorerMyComputerBackupPath*ersionExplorerMyComputerclea nuppath*ersionExplorerMyComputerDefragPath*HKLMSOFTWAREMicrosoftWi ndows NTCurre ntVersio nAccessibilityUtility Man ager*安全模式配置參數(shù) HKLMSYSTEMCurre ntC on trolSetC o

37、n trolSafeBootAlternateShell*HKEY_LOCAL_MACHINESYSTEM*Co ntrolSet*C on trolSafeBootMi nimal*HKEY_LOCAL_MACHINESYSTEM*C on trolSet*C on trolSafeBootNetwork*DrWaston32配置參數(shù)HKEY_LOCAL_MACHINESOFTWAREMicrosoftWi ndowsNTCurrentV ersionAeDebugAuto*HKEY_LOCAL_MACHINESOFTWAREMicrosoftWi ndowsNTCurrentV ersio

38、nAeDebugDebugger*系統(tǒng)環(huán)境變量參數(shù)HKEY_LOCAL_MACHINESYSTEM*Co ntrolSet*C on trolSession Man agerE nvironment* HKEY_CURRENT_USERE nvironment*HKEY_USERS*E nvironment*命令提示符配置參數(shù) HKEY_LOCAL_MACHINESYSTEM*Co ntrolSet*Co ntrolSessio nMan agerE nviro nmen tComSpec*OutlookExpress設(shè)置參數(shù)儲(chǔ)存位置HKEY_CURRENT_USERIde ntities*S

39、oftwareMicrosoftOutlook Express*啟動(dòng)和故障恢復(fù)配置參數(shù)*SYSTEM*Co ntrolSet*Co ntrolCrashC on trol* 證書-受信任的發(fā)行者HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificatesTrustedPublisherCertifi cates*系統(tǒng)還原配置參數(shù)*SOFTW AREMicrosoftWi ndows NTCurre ntV ersio nSystemRestore*Windows自動(dòng)更新配置參數(shù)*SOFTW AREMicrosoftWindowsCurrentV ersionWindowsUpdateAuto Update*Windows防火墻配置參數(shù)HKEY_LOCAL_MACHINESYSTEM*C on trolSet*ServicesSharedAccessParametersFirewall Policy*HKEY_LOCAL_MACHINESYSTEM*C on trolSet*ServicesSharedAccessParametersFirewall PolicyDomai nProfile*HKEY_LOCAL_MACHINESYSTEM*C on trolSet*ServicesSha