Key Takeaways
- Block users from opening the Windows Registry Editor.
- Helps prevent unauthorized users from accessing the Registry Editor and making potentially harmful configuration changes.
- Allows IT administrators to configure and manage registry access restrictions from the Microsoft Intune admin center.
- Enables administrators to target specific groups according to organizational requirements.
Here’s a step-by-step guide on how to block Windows Registry Access using Intune. You can Prevent access to the Windows registry editor Regedit.exe. This setting also determines whether the registry can run on the device silently. The Windows Registry is used by Windows to store configuration settings and options. It plays a critical role in the proper functioning of the operating system and various applications. However, if not properly secured, it can be exploited by malicious actors to compromise system stability and data security.
Table of Contents
Table of Contents
Block Windows Registry Access using Intune Policy to Improve Device Security
Preventing access to the registry is a security measure frequently implemented in organizations to enhance overall security. By default, standard user accounts run with limited privileges and require the administrator consent to modify the Registry. This helps prevent unauthorized changes. Admins can configure the Policy to disable registry access for specific user accounts or groups. This policy effectively blocks users from opening the registry editor, helping prevent unintended or unauthorized use of the Windows editor.
However, planning and implementing this policy carefully is important, as legitimate system administration tasks often require registry access. Administrators should ensure that necessary exceptions are made for IT persons or users who require such access for their roles.
- Configure Registry Processing Policy Using Intune
- Deploy Registry Fix Using Intune Win32 App
- Enforce Secure File and Registry Redirection for Applications using Intune Policy
- Configure Registry Processing Policy using Intune
Block Windows Registry Access using Intune
Microsoft Intune allows administrators to manage Windows device settings and apply security policies centrally. By using the Settings Catalog, administrators can configure policies to restrict access to the Windows Registry Editor on managed devices. First, sign in to the Microsoft Intune admin center using your administrator credentials. Navigate to Devices from the left navigation pane. Then, select Configuration profiles to create and manage device configuration policies.
- Sign in to the Microsoft Intune Admin portal.
- Select Devices > Configuration profiles > Create profile.
Create a Profile
In the Create Profile section, select Windows 10 and later as the platform. Under Profile Type, select Settings Catalog. This option allows you to configure the required Windows settings. After selecting the platform and profile type, click on the Create button. You will then be directed to the Basics tab to enter the profile details.
Basic Details
In Basics, enter the descriptive name for the new profile. For example, Disable Windows Registry Access or Prevent users access to registry editor, and add a description for the profile to understand the policy usage here, I add that, Disables the Windows registry editor Regedit.exe and Select Next.
Configuration Settings
On the Configuration settings tab, With the settings catalog, you can choose which settings you want to configure. Click on Add Settings to browse or search the catalog for the settings you want to configure. Search for “Registry editing tools” or “Prevent access to the registry”. Select the “Administrative Templates\ System” from the search result. Select “Prevent access to the registry editing tools (User)” and close the pane. If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action.
- If you disable this policy setting or do not configure it, users can run Regedit.exe normally.
- To prevent users from using other administrative tools, use the “Run only specified Windows applications” policy setting.
Configuration settings Defaulted Value
After selecting the Prevent access to the registry editing tools policy under the Windows settings, you will be directed to the main Configuration settings page. Here, you can see that the policy is disabled by default. To block users from accessing the Windows Registry Editor, you need to change the policy state to Enabled. Once enabled, this policy prevents users from opening the Registry Editor on the targeted devices.
Enable Windows Registry Access Configuration settings
The next step is to toggle “Prevent access to registry editing tools” to Enabled. Once you enable the option, the selected setting will appear and click on Next. This policy setting prevents users from running the registry editor, regedit.exe. This policy setting also determines whether regedit can run silently on the computer. Here we have configured the Disable regedit from running silently, to No.
Scope Tags
In the Scope tags section, I selected London as the scope tag and clicked on Next to continue with the configuration. Scope tags help administrators control which IT administrators can access and manage the policy in the Microsoft Intune admin center. You can assign the appropriate scope tags based on your organization’s administrative requirements. If no scope tag is required, you can proceed with the default settings.
Assignments
In the next step, navigate to the Assignments section, where you can add groups under Included groups. Here, I added the HTMD test policy and HTMD CPC test groups to assign the policy to the required groups. Group assignments help determine which users or devices will receive the policy. After adding the groups, click on Next to proceed to the next step.
Review + Create
The next and final step is the Review + create section, where you can review all the details entered during the policy creation process. Here, you can verify the basic details, configuration settings, scope tags, and assignments displayed on the screen. If you find any changes that need to be made, you can go back to the previous sections and update the details. Otherwise, click on Create to complete the policy creation process.
A notification will appear automatically if you see it in the top right-hand corner. You can easily see that the Policy “Disable Windows Registry Access” was created successfully. Also, if you check the Configuration Profiles list, the Policy is visible there with the tag NEW.
Monitor Windows Registry Access Policy Deployment
Intune provides several features to monitor and manage device configuration profiles. Once the configuration profile is applied, Registry access should be disabled on the targeted devices.
To monitor Intune policy assignment, from the list of Configuration Profiles, select the policy you targeted, and here you can check the device and user check-in status. If you click View Report, additional details are displayed. Additionally, you can quickly check the update as devices/users check-in status reports:
Note! The device groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Monitor Event Log for Windows Registry Access Policy Deployment
Intune event IDs 813 or 814 can indicate that a string policy has been applied to Windows 10 or 11 devices. These event IDs can provide valuable information about the policy that has been applied, including the exact value of the policy enforced on those devices. In the case of the policy mentioned earlier, which prevents access to the Windows registry, event ID 814 would be used to indicate that the string policy has been applied, and you can view the specific value of the policy.
- To confirm this, check the Event log path > Applications and Services Logs > Microsoft > Windows >Devicemanagement-Enterprise-Diagnostics-Provider> Admin.
| Policy Information |
|---|
| MDM PolicyManager: Set policy string, Policy: (DisableRegedit), Area: (ADMX_ShellCommandPromptRegEditTools), EnrollmentID requesting merge: (5B88AEF1-09E8-43BB-B144-7254ACBBDF3E), Current User: (S-1-12-1-3186897695-1137825691-1845872004-278613382), String: (), Enrollment Type: (0x6), Scope: (0x1). |
Registry Settings Details
To check the policy deployment, You can validate the registry details for disabling Windows registry access at the below location. Of course, Once you disable the access, you won’t have control to validate registry changes, You can use the registry for controlling the registry editor.
| Registry Hive | HKEY_CURRENT_USER |
| Registry Path | Software\Policies\Microsoft\Windows\System |
| Value Name | DisableRegedit |
| Value Type | REG_DWORD |
| Enabled Value | 0 |
| Disabled Value | 1 |
End Users Experience
If you enable the policy and the user tries to open a registry, the system displays a message explaining that a setting prevents the action. A popup will appear with the message, Registry editing has been disabled by your administrator.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
About Author – Jitesh, Microsoft MVP, has over six years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10/11 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.