Windows Registry Security: A Complete Guide

The Windows registry is a critical database that requires special protection. This guide shows you how to secure and manage the registry effectively.

1. Permission Management

ACL Configuration

# Afficher les permissions d'une clé
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s

# Modifier les permissions d'une clé
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ProgramName" /t REG_SZ /d "C:\Program\Path" /f

# Supprimer une clé
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ProgramName" /f

Protecting Sensitive Keys

# Script de protection des clés sensibles
function Protect-RegistryKeys {
    $sensitiveKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
        "HKLM:\SYSTEM\CurrentControlSet\Services"
    )
    
    foreach ($key in $sensitiveKeys) {
        $acl = Get-Acl $key
        $acl.SetAccessRuleProtection($true, $false)
        Set-Acl $key $acl
    }
}

2. Registry Monitoring

Detecting Changes

# Script de surveillance du registre
function Monitor-RegistryChanges {
    param (
        [string]$RegistryPath,
        [string]$OutputFile
    )
    
    $watcher = New-Object System.IO.FileSystemWatcher
    $watcher.Path = $RegistryPath
    $watcher.NotifyFilter = [System.IO.NotifyFilters]::LastWrite
    $watcher.EnableRaisingEvents = $true
    
    $action = {
        $path = $Event.SourceEventArgs.FullPath
        $changeType = $Event.SourceEventArgs.ChangeType
        $timestamp = (Get-Date).ToString()
        Add-Content $OutputFile "$timestamp - $changeType - $path"
    }
    
    Register-ObjectEvent $watcher "Changed" -Action $action
}

Auditing Changes

# Configuration de l'audit du registre
auditpol /set /category:"Registry" /success:enable /failure:enable

# Script d'analyse des logs
function Analyze-RegistryLogs {
    $events = Get-EventLog -LogName Security -Source "Security" -After (Get-Date).AddHours(-24)
    $registryEvents = $events | Where-Object {$_.EventID -eq 4656 -or $_.EventID -eq 4657}
    
    foreach ($event in $registryEvents) {
        Write-Host "Modification du registre détectée: $($event.TimeGenerated) - $($event.Message)"
    }
}

3. Protection Against Malware

Detecting Malicious Changes

# Script de détection des modifications malveillantes
function Detect-MaliciousRegistryChanges {
    $suspiciousPatterns = @(
        ".*\.exe$",
        ".*\.dll$",
        ".*\.bat$",
        ".*\.cmd$"
    )
    
    $startupKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    )
    
    foreach ($key in $startupKeys) {
        $values = Get-ItemProperty $key
        foreach ($value in $values.PSObject.Properties) {
            foreach ($pattern in $suspiciousPatterns) {
                if ($value.Value -match $pattern) {
                    Write-Host "Valeur suspecte détectée dans $key : $($value.Name)"
                }
            }
        }
    }
}

Cleaning Up the Registry

# Script de nettoyage du registre
function Cleanup-Registry {
    # Suppression des clés orphelines
    $orphanedKeys = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | 
        Where-Object { -not (Test-Path $_.PSPath) }
    
    foreach ($key in $orphanedKeys) {
        Remove-Item $key.PSPath -Force
    }
    
    # Nettoyage des entrées de démarrage
    $startupKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    )
    
    foreach ($key in $startupKeys) {
        $values = Get-ItemProperty $key
        foreach ($value in $values.PSObject.Properties) {
            if (-not (Test-Path $value.Value)) {
                Remove-ItemProperty $key -Name $value.Name
            }
        }
    }
}

4. Backup and Restore

Backing Up the Registry

# Script de sauvegarde du registre
function Backup-Registry {
    $backupPath = "C:\RegistryBackup"
    if (-not (Test-Path $backupPath)) {
        New-Item -ItemType Directory -Path $backupPath
    }
    
    $timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
    $backupFile = Join-Path $backupPath "registry_backup_$timestamp.reg"
    
    # Sauvegarde des clés importantes
    $importantKeys = @(
        "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKLM\SYSTEM\CurrentControlSet\Services",
        "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    )
    
    foreach ($key in $importantKeys) {
        reg export $key "$backupFile" /y
    }
}

Restoring the Registry

# Script de restauration du registre
function Restore-Registry {
    param (
        [Parameter(Mandatory=$true)]
        [string]$BackupFile
    )
    
    if (Test-Path $BackupFile) {
        reg import $BackupFile
        Write-Host "Restauration du registre effectuée avec succès"
    } else {
        Write-Host "Fichier de sauvegarde non trouvé"
    }
}

5. Best Practices

Security Verification

# Script de vérification de sécurité du registre
function Test-RegistrySecurity {
    $issues = @()
    
    # Vérification des permissions
    $sensitiveKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\SYSTEM\CurrentControlSet\Services"
    )
    
    foreach ($key in $sensitiveKeys) {
        $acl = Get-Acl $key
        if (-not ($acl.Access | Where-Object {$_.IdentityReference -eq "NT AUTHORITY\SYSTEM"})) {
            $issues += "Permissions incorrectes sur $key"
        }
    }
    
    # Vérification des valeurs suspectes
    $startupKeys = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    )
    
    foreach ($key in $startupKeys) {
        $values = Get-ItemProperty $key
        foreach ($value in $values.PSObject.Properties) {
            if ($value.Value -match "\.(exe|dll|bat|cmd)$") {
                $issues += "Valeur suspecte dans $key : $($value.Name)"
            }
        }
    }
    
    return $issues
}

Automated Maintenance

# Script de maintenance du registre
function Update-RegistrySecurity {
    # Protection des clés sensibles
    Protect-RegistryKeys
    
    # Nettoyage des entrées orphelines
    Cleanup-Registry
    
    # Sauvegarde du registre
    Backup-Registry
    
    # Vérification de sécurité
    $issues = Test-RegistrySecurity
    foreach ($issue in $issues) {
        Write-Host "Problème détecté : $issue"
    }
}

Conclusion

Securing the Windows registry requires:

• Strict permission management
• Constant monitoring
• Regular backups
• Precise documentation

Key takeaways:

• Protect sensitive keys
• Monitor changes
• Clean up regularly
• Maintain backups
• Follow best practices