Managing The Windows 2000 Registry

Remote Registry Editing

RegEdt32 originated the concept of remotely editing another machine’s Registry. This is invaluable for administrators, since it gives you the ability to peek into the Registry of a misconfigured or broken machine from the comfort of your office. As with most magic powers, this ability to edit the Registry from afar has some associated constraints and requirements.

First of all, you must have sufficient privilege to see the Registry on the remote machine. By default, NT Workstation machines allows anyone to connect to their Registries, as does NT Server Version 3.51 and earlier. NT Server 4.0 turns remote access off; Windows 2000 Professional and Server turn it on again. This privilege, which is discussed in the section Limiting Remote Registry Access in Chapter 9, lets you view HKU and HKLM on the remote machine, but that’s all. If you want to see the contents of HKCR, HKCC, or HKCU, you have to look in the appropriate section of the two keys you can see.^[27]

Next, you must be able to modify the Registry on the remote machine. Let’s say you’re logged into a machine where your account has Administrator privileges. If you use RegEdt32 to open the Registry of another machine on your network where your account doesn’t have Administrator access, you can see that machine’s HKLM and HKU entries but you can’t open them! This also holds true when your machine and/or the target are members of the same domain: to change data on the remote machine, you must have ...