The registry locations worth knowing
These are the places persistence tricks, policy hijacks and everyday tweaks live — the same knowledge the .reg file viewer uses for its safety verdicts.
High-risk locations
Image File Execution Options (IFEO)
A developer-debugging hook: Windows launches the program listed in the Debugger value INST… Winlogon (Shell / Userinit)
Controls what Windows launches at logon — the Shell value is Explorer itself, Userinit run… AppInit_DLLs host key
The AppInit_DLLs value here forces a DLL to load into nearly every program that draws a wi… Microsoft Defender policy settings
Group-policy overrides for Windows' built-in antivirus — including switches that disable r… Executable file-type handler
Tells Windows HOW to run .exe/.cmd/.bat files themselves.… Shell service objects (delay load)
COM objects Explorer loads automatically at startup.… an autostart (Run/RunOnce) entry
Programs listed here start automatically at every logon (Run) or once at the next logon (R…
A developer-debugging hook: Windows launches the program listed in the Debugger value INST… Winlogon (Shell / Userinit)
Controls what Windows launches at logon — the Shell value is Explorer itself, Userinit run… AppInit_DLLs host key
The AppInit_DLLs value here forces a DLL to load into nearly every program that draws a wi… Microsoft Defender policy settings
Group-policy overrides for Windows' built-in antivirus — including switches that disable r… Executable file-type handler
Tells Windows HOW to run .exe/.cmd/.bat files themselves.… Shell service objects (delay load)
COM objects Explorer loads automatically at startup.… an autostart (Run/RunOnce) entry
Programs listed here start automatically at every logon (Run) or once at the next logon (R…
Review-carefully locations
Windows Update policy
Group-policy control over how (and whether) Windows updates itself.… a Windows service definition
Configuration for a background service or driver: its executable, start mode and parameter… a Group Policy setting
Policy keys enforce settings the normal Settings app can't change back — the mechanism beh… an Explorer context-menu handler
Registers a DLL that adds entries to right-click menus in Explorer.…
Group-policy control over how (and whether) Windows updates itself.… a Windows service definition
Configuration for a background service or driver: its executable, start mode and parameter… a Group Policy setting
Policy keys enforce settings the normal Settings app can't change back — the mechanism beh… an Explorer context-menu handler
Registers a DLL that adds entries to right-click menus in Explorer.…
Everyday settings
a file-type association
Maps a file extension (like .txt or .pdf) to the program and actions that handle it.… an Add/Remove Programs entry
The metadata shown in Settings → Apps: display name, publisher, uninstall command.… Explorer view settings
File Explorer preferences: hidden files, file extensions, taskbar behaviours.… a per-user Control Panel setting
Your personal desktop, mouse, keyboard and accessibility preferences.… Task Manager's startup enable/disable state
Records which autostart entries you've toggled off in Task Manager's Startup tab.…
Maps a file extension (like .txt or .pdf) to the program and actions that handle it.… an Add/Remove Programs entry
The metadata shown in Settings → Apps: display name, publisher, uninstall command.… Explorer view settings
File Explorer preferences: hidden files, file extensions, taskbar behaviours.… a per-user Control Panel setting
Your personal desktop, mouse, keyboard and accessibility preferences.… Task Manager's startup enable/disable state
Records which autostart entries you've toggled off in Task Manager's Startup tab.…
Also: registry value types (REG_SZ, DWORD, MULTI_SZ…) explained →