Winlogon (Shell / Userinit)

What lives here

Controls what Windows launches at logon — the Shell value is Explorer itself, Userinit runs before your desktop appears.

What changing it does

Changing Shell or Userinit replaces or adds to what runs the moment you log in. Malware loves this spot; a wrong value here can also make the desktop fail to load at all.

Risk level: danger. A .reg file from an unknown source touching this location deserves real scrutiny before you merge it.

Deciding whether to trust a file at all? Read the guide: Is this file safe to open?