Windows Security

Windows Security
Registry

The registry is a hierarchical database that stores the values

of variables in Windows and the applications and services
that run on Windows. The operating system and other
programs also use the registry to store data about users and
about the current configuration of the system and its
components.

The registry is available whenever the system is running,

programs that start and stop can keep persistent data in the
registry.
 Structure of the Registry

Much of the registry consists of nested containers known as

subtrees, keys, and subkeys, which are like folders.

The actual data is stored in the registry entries, the lowest level
element in the registry.

The series of nested containers make up a path to each entry.

Because entry names are unique only within a path, entries are
referenced by their full registry path and name.
 Subtree

Subtrees are the root, or primary divisions, of the registry.

The Windows Server 2003 registry is divided into five subtrees.

Subtrees themselves do not contain configuration data; they contain
the keys, subkeys, and entries in which the data is stored.

Click the name of a subtree to see its description

 Subtree

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG
 Hive Files

The permanent parts of the registry are stored as a set of files

called the hive files.

You can find a list of locations for these files in the hivelist
subkey in HKLM\SYSTEM\CurrentControlSet\Control.

These files are saved in systemroot\System32\Config and

updated with each login.
 Hive Files

They consist of the following files, which store four of the five
keys in HKEY_LOCAL_MACHINE and one key in HKEY_USERS:

SAM Contains information stored in the key HKLM\SAM about the

Security Accounts Manager (SAM) service.

SECURITY Contains the security information stored in the key

HKLM\SECURITY.
 Hive Files

SOFTWARE Contains information stored in the key

HKLM\SOFTWARE about the computer's software
configuration.

SYSTEM Contains information stored in the HKLM\SYSTEM

about the computer's system configuration.

DEFAULT Contains the default system information that is

stored in the key HKEY_USERS\.DEFAULT.
 Registry Editor

A utility by the filename regedit.exe that allows you to see,

search, modify and save the registry database of Windows.

Doesnt validate the values you are writing: it allows any

operation, so pay close attention.
Hack Windows 7 Admin Account

Lets do it.
Thank You!!