> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/windows-discovery/windows-registry-enumeration.md).

# Windows Registry Enumeration

The *registry* is a system-defined database in which applications and system components store and retrieve configuration data. The data stored in the registry varies according to the version of Microsoft Windows. Applications use the registry API to retrieve, modify, or delete registry data.

You should not edit registry data that does not belong to your application unless it is absolutely necessary. If there is an error in the registry, your system may not function properly. If this happens, you can restore the registry to the state it was in when you last started the computer successfully. For more information, see the help for your operating system.

For more information on the registry database and programmatic access to the registry data, see the following topics:

* [About the Registry](https://learn.microsoft.com/en-us/windows/win32/sysinfo/about-the-registry)
* [Using the Registry](https://learn.microsoft.com/en-us/windows/win32/sysinfo/using-the-registry)
* [Registry Reference](https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-reference)

## Enumeration with reg.exe

To query all [Run and RunOnce registry keys](https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys) with `reg.exe`

```batch
reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
```

## Enumeration with Get-ItemProperty

To query all Run and RunOnce registry keys with `Get-ItemPoperty`

```powershell
Get-ItemProperty Registry::HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Get-ItemProperty Registry::HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Get-ItemProperty Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Get-ItemProperty Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
```

## Resources

**Get-ItemProperty** - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-5.1>

Predefined Registry Keys - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/sysinfo/predefined-keys>

**reg query** - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-query>

Registry Hives - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-hives>