How the WIN8 system opens and connects the Remote Registry service

In Windows, the Remote Registry service is a standard, supported service by the WIN8 system. This can be seen from two ways.

One is to see the presence of this feature in the file → Connect network Registry menu in Registry Editor.

Second, when you enter the command "Services.msc" in the "Run" dialog box and press ENTER, you can see the service items specifically designed for the Remote Administration Registry in the Services window that pops up.

Where the latter is the service item that is used to open the Remote Administration Registry feature, which is used to connect to the remote registry. Obviously, to turn on the Remote Administration Registry feature, you need to double-click the remote Registry Service item in the Job window to enable it in the pop-up Properties window shown in the picture.

After you turn on the Remote Administration Registry feature, you can click the file → Connect network Registry menu item in the Registry Editor, and then enter the IP address of the remote computer in the pop-up dialog box to prepare for the connection.

Because the registry belongs to the core database in the system, the Login dialog box will pop up later, and you must enter an account with administrator privileges to log in.

After you complete the login, the registry administrator entry for the remote computer appears in Registry Editor.

At this point, you can manage the remote registry, such as new, delete, rename, and so on.

When you have finished modifying the registry of the remote host, you need to disconnect the network registry by selecting the name or IP address of the remote WIN8 download computer in the Registry Editor window, clicking the right mouse button and choosing Disconnect from the pop-up menu.

In addition to analyzing other registry forms, we can also customize some special 橾 by loading the hive files. For example, you can customize a newly created account to run only once when you log in. The specific methods are:

Open the Registry Editor window by typing "Regedt32" in the Run column and pressing ENTER. When you have selected the HKEY_USERS subtree, click the file → load hive menu.

In the Load Hive window, select the Ntuser.dat file in the C:documentsandsettingsdefaultuser folder.

When you click the Open button, in the dialog box that pops up, enter the name of the new item, such as test.

In the Registry Editor window, expand sequentially to the following: Hkey_userstestsoftwaremicrosoftwindowscurrentversion

Under the CurrentVersion subkey, create a new item named "Runonce", select the "Runonce" item, and on the right, make a REG_SZ value named Test.bat (optionally named), and enter its property content into the file path and file name that you want to run once ( such as C:test.bat).

When the text item is selected, click the file → uninstall hive menu, and then click Yes in the pop-up dialog box to confirm the uninstall operation.

When you close the Registry Editor window, create a new account in the system with an arbitrary name and log on using this account. The C:test.bat file is automatically invoked after you log on to the desktop environment. This call will only occur the first time a new account is logged on, and will not occur during subsequent logons.

In addition, you can use the WinPE boot CD to look up, modify, or import/export registry content, and the method is simple. Therefore, we can say that the design of the WIN8 system registry in terms of local security is very weak. Many experienced computers have been able to make changes to the registry almost arbitrary after they log on to the mainframe.