2 - Security Policy and Registry Flashcards
What are Windows Security Policies?
(Definition)
Windows Security Policies are a set of configurations that can be applied on desktops to enhance security.
What do Windows Security Policies determine?
Security policies determine the various security restrictions that can be imposed on the users in a network.
Where can the security settings for Active Desktop, Computer, Control Panel, Explorer, Internet Explorer, Network, and System categories be defined?
The above policies can be defined using Security Policies Configuration
Name the three categories of keys that exist in the Windows registry.
The three types / categories of keys in the Window Registry are:
- Root Keys
- Subkeys
- Value entries
How many Root keys are there?
Hint: answer is a number
5
What is another name for Root keys?
High Level keys
Each root key contains one or more subkeys.
[True / False]
True
Subkeys can have their own subkeys.
[True / False]
True
Value entries contain what three pieces of information?
- Name
- Data Type
- Value
Name the 5 main Root keys.
- HKCR - HKEY_CLASSES_ROOT - Associates filename extensions (such as .doc and .exe) with the actions Windows is supposed to take when, for example, you double-click a file.
- HKCU - HKEY_CURRENT_USER - Controls many settings for the currently logged-on user, from the user’s name to his or her desktop background.
- HKLM - HKEY_LOCAL_MACHINE - Thousands of settings that apply to all users, no matter who is logged on to the PC at any given moment.
- HKU - HKEY_USERS - A collection of all the HKCU entries for everyone who has ever logged on to the PC.
- HKCC - HKEY_CURRENT_CONFIG - A tiny key that describes the current hardware configuration and a few basic system settings.
How many subkeys does HKLM have?
6
Name the 6 HKLM subkeys
- SAM
- SECURITY
- SYSTEM
- SOFTWARE
- HARDWARE
- BCD
Describe the HKLM SAM subkey.
SAM – This subkey appears empty to most users. It is used with the security and accounts management databases.
Describe the HKLM SECURITY subkey.
SECURITY – This is more security-related information that appears blank to most users.
Describe the HKLM SYSTEM subkey.
SYSTEM – This information is created by users with administrative privileges. It includes the Windows settings, file system information, and critical hardware configurations as well as other information needed to run the core system.
Describe the HKLM SOFTWARE subkey.
SOFTWARE – This area is used by both Windows and application programs to store critical configuration settings.
Describe the HKLM HARDWARE subkey.
HARDWARE – This subkey contains relevant information on all connected plug-and-play devices.
Describe the HKLM BCD subkey.
BCD – This subkey stores, the boot configuration data.
In the Windows Registry, some values are in plain text and readable, and some are in binary.
[True / False]
True
Provide a description of the String Values found in the Windows registry.
String values are indicated by a small red icon with the letters “ab” on them. These are the most commonly used values in the registry, and also the most human-readable.
How is a multi-string value different from a String Value?
(Windows Registry)
A multi-string value is similar to a string value, with the only difference being that they can contain a list of values instead of just one line.
Not all multi-string values have more than one entry.
[True / False]
True
Note: Not all multi-string values have more than one entry. Some function the exact same way as single string values, but have the additional space for more entries if they need it.
How is an Expandable String Value different from a String Value?
(Windows Registry)
An expandable string value is just like the string value from above, except that they contain variables. When these types of registry values are called upon by Windows or other programs, their values are expanded out to what the variable defines.
Most expandable string values are easily identified in Registry Editor because their values contain % signs.
[True / False]
True
What is the TMP expandable string value?
%USERPROFILE%\AppData\Local\Temp
What is a benefit to a registry value like the following:
%USERPROFILE%\AppData\Local\Temp
The benefit to this type of registry value is that the data doesn’t need to contain the username of the user because it uses the %USERPROFILE% variable.
Provide a description of the Binary Values found in the Windows registry.
As the name suggests, these types of registry values are written in binary.
What color are Binary Value icons in the Registry error?
Binary value icons in Registry Editor are blue with ones and zeros.
How many bits are in a DWORD?
32-bits
How many bits are in a QWORD?
64-bits
DWORD and QWORD values can be expressed in either decimal or hexadecimal format.
[True / False]
True
String values are indicated by what icon?
ab
