Thursday, August 22, 2002

System Policies for the restriction of Display settings (Part 2)

mad hack
The description of the system policies intended for the Display settings restriction is continued in this article.

Screen Saver, besides the functionality of User Interface decoration, can have the functions of security and discretionary access, when it has enabled the password protection. Screen Saver, like every application, demands substantial resources to work. The latest versions of screen savers are drastically saturated with graphics, what could slow the system down, especially during initial start. This can have an effect, for example, on performance of the disk defragmentation program. Next three system policies are dedicated to restrictions imposing on Screen Saver.

Disable screen savers from running while Disk Defragmenter Active

This system policy can be applied to Windows versions 9.x and ME. It is stored in the "Default" value, in the "Software\Microsoft\Windows\CurrentVersion\ Applets\Defrag\Settings\DisableScreenSaver" key, located in the HKEY_CURRENT_USER hive. Two Boolean values: "Yes" and "No" respond for the state of this policy. Which of values corresponds to which state of this policy, I think, is clear from the literal meanings of these words in English. If the "Default" value does not store anything, this means that the policy is not enabled. While in enabled state, this policy blocks the screen saver launching when the Disk Defragmenter is active.

The launch of screen saver during the disk defragmenter active can slow down or interrupt the disk defragmenter routine. Here it is necessary to note that this policy affects only the defragmentation program which is provided together with Windows. This system policy does watch the work of disk defragmentors from other vendors, for example, from the Norton Utilities package.

No screen saver

This system policy works in Windows versions 2000 and XP. If this policy is enabled, it will prohibit Screen Saver from launching and blocks all "Screen Saver" section with saver settings. It is stored in DWORD "ScreenSaveActive" value in "Software\Policies\Microsoft\Windows\Control Panel\Desktop" key of HKEY_CURRENT_USER system registry hive. The "0" value means active state of this policy and protection of the Screen Saver launch. The "1" or its absence is analogous to the state, when the policy is not configured and there is no prohibition to Screen Saver against launching or their settings adjusting.

Password protect the screen saver

This system policy can be also applied only in Windows versions 2000 and XP. Comparing with other system policies given in this article, its state can be represented by a pair of Boolean values, coming to the binary "yes" or "no". It has three states. This policy is stored in HKEY_CURRENT_USER hive in DWORD "ScreenSaverIsSecure" value, which must be located in "Software\Policies\Microsoft\Windows\Control Panel\Desktop" key. This policy responds to, whether the Screen Savers, which are used in Windows system, resort to passwords and prohibits setting (changing) Screen Saver password by means of Display Properties application.

This policy has three states:

  1. The "ScreenSaverIsSecure" value is absent in system registry. The behavior of screen saver is usual and the passwords can be changed, set or using of them can be canceled with the aid of check box window "Password protected".
  2. The value stores "0". In this case, the password protection is compulsorily disabled.
  3. When the value is "1" the passwords for screen savers are compulsorily enabled.

If the "ScreenSaverIsSecure" value is present in "Software\Policies\Microsoft\Windows\Control Panel\Desktop" system registry key and it stores any of "1" or "0" values, it means that the policy is in active state and the check box window is blocked. On the other hand, it will be impossible to enable or disable password protection until the value is deleted from the registry.

The above-described policy "No Screen Saver" has the priority over this policy. If the policy "No Screen Saver" is enabled state, the system ignores the state of "Password protect the screen saver" policy.

Allow only bitmapped wallpaper

This system policy, having the range of Current User, allows using only bitmapped images of bmp-format for the Desktop wallpaper. It ought just now to mention that it can be applied for Windows 98, ME, 2000 and XP. The policy will work in Windows 95 and NT, with Explorer 4.0x or higher installed together with the "Active Desktop". And, on condition, that the "Active Desktop" is not disabled by the system policy. It is related to the "Active Desktop" management and that is why its consideration is out of topic of present article.

The DWORD "NoHTMLWallPaper" value, stored in "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" key in HKEY_CURRENT_USER hive, responds for state of this policy. This value accepts two states "1" or "0". The "0" value or its absence disables the system policy.

Disable Changing Wallpaper

This system policy, having also the range of Current User, prohibits from Desktop wallpaper changing. Like previous policy, it is related to the policies for "Active Desktop" management and works in Windows 98, ME, 200 and XP. "Disable Changing Wallpaper" can be applied in Windows 95 and NT, when Internet Explorer 4.0x is installed with the "Active Desktop".

The DWORD "NoChangingWallpaper" value, located in "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" key, in HKEY_CURRENT_USER hive. This value can have two states: "1", when the policy is enabled, or "0" (absence of value), when the policy is not activated. If the "Active Desktop" is not installed or it is disabled by the policy, this policy is ignored.

Disable Display in Control Panel

This policy prohibits Display application from launching and using. When it is activated, it will be necessary to work directly with registry by means Regedit or third-party vendors utilities to change the Display settings. Its range is Current User. The message is appeared, while attempt to launch Display application, explaining that Administrator disabled Display.

DWORD "NoDispCPL" value accepts two of Boolean values: "1" or "0". Its "0" value or its absence disables the system policy. The value "1" activates the system policy. This value is stored in "Software\Microsoft\Windows\CurrentVersion\Policies\System" key, in HKEY_CURRENT_USER hive.

The implementation in Activity and Authentication Analyzer

In order to see the state of some of above-mentioned policies or to manipulate them in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Control Panel, later Display and find in the right list items corresponding to these policies named:

  • Disable Screen Saver while Disk Defragmenter Active
  • No screen saver
  • Password protect the screen saver

In order to see the state of some of above-mentioned policies or to manipulate them in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Active Desktop and find in the right list items corresponding to these policies named:

  • Allow only bitmapped wallpaper
  • Disable Changing Wallpaper

To see the state of Disable Display in Control Panel policy or to manipulate it in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Control Panel and find in the right list item corresponding to the policy named:

  • Disable Display in Control Panel

Thursday, August 15, 2002

System Policies for the restriction of Display settings

mad hack
The article gives the System Policies intended to restrict the change of Display settings.

This article is dedicated in the most to the system policies allow restricting the access to the settings available through the Display applet in the Control Panel. The Display applet is accessible in Windows in several places. It is located in the Control Panel. Or it can be called using context menu, by clicking with right mouse button on the empty place on the Desktop and later by selecting the corresponding menu item.

There can be the situation, when the system administrator encounters the necessity to restrict access of the not skilled users to the Display settings. For instance, wrong refresh rate may have the result of physical damage to the monitor. The proper adjustment of Display settings may increase video subsystem performance rate as well as system general performance rate. The increasing of refresh rate diminishes the flicker effect, betters the comfort of work. That is called the ergonomic features. The Active Desktop settings are closely linked with Display settings. The last: the Active Desktop can be the breach in the system security. But, the Active Desktop has a lot of own settings and system policies, which consideration is out of topic of this article.

The most of the system policies illustrated in this article are stored in the values, which are or can be located in HKEY_CURRENT_USER system registry hive. It ought to note the general rule. That is to say: the policies stored in the HKEY_CURRENT_USER have the Current User scope, but not the entire Computer.

Hide Screen Saver Page

This policy works in all Windows versions and, being enabled, removes the Screen Saver page from the applet for the Display settings in Control Panel. The Screen Saver selection, its settings customisation, Energy saving features of monitor and computer will not be accessible, but through the direct work with the system registry. For instance, exit from the hibernation mode can lead to the hang-up of mouse or system in the whole. The Screen Saver removing, customisation and password change respectively will not be available, what can create the additional illusion of being secured for user and administrator.

The state of this system policy is stored in numeric value "NoDispScrSavPage" in key "Software\Microsoft\Windows\CurrentVersion\Policies\System" of HKEY_CURRENT_USER hive. The value equal to "1" is the active state of policy. The value "0" or its absence, what is equivalent to the state by default, means that policy is not applied or what is the same that the policy is in disabled state.

Disable UI to change menu animation setting

The animation effects for the Windows, menus and lists are created to vary that user's work, who likes transition effects, but can annoy or distract others from the work, who get accustomed to the classic interface or tired from long stay before the computer. The menu shading effect, drawing with explosion or sliding effects are, for example, considered as the animation effects.

The check box "Use transition effects for menus and tooltips", standing for the enabled or disabled state of the animation effects, is located on the Effects page of Display applet.

This system policy, fit for the Windows versions ME, 2000 and XP, while enabled, removes all the video animation effects. The option for the "Use transition effects for menus and tooltips" is also disabled, the dimming effect is applied on the check box, showing that the very possibility to turn on the animation effects is not available. This policy state is stored in the numeric value "NoChangeAnimation" in "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" registry key. This policy can be stored in both either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER hives, and has the scope of either Current User or Local Machine respectively. A pair of Boolean values: "1" (enabled state) and "0" (disabled state) respond for representation of this policy. If the value is not present, this is equivalent to state by default - disabled policy. If conflict exists between policies applied both to Local Machine and Current User, the policy stored in HKEY_LOCAL_MACHINE has the priority over the policy which value stored in HKEY_CURRENT_USER.

Disable UI to change keyboard navigation indicator setting

This system policy, which works in Windows 2000 and XP is kindred to above-described system policy "Disable UI to change menu animation setting". The keyboard navigation indicator is the underlining indicating the hot key. If this policy is enabled, the navigation indicators are displayed only when the "Alt" key is pressed. The underlining, like animation effects for windows, menus and lists are also created for diversification of work for user, who likes the transition effects, but can embarrass or distract form job.

The option, which is the check box for turning on the effect of underlining, is located on the Effects page and named: "Hide keyboard navigation indicators until I use the ALT key". While the option "Hide keyboard navigation indicators until I use the ALT key" is blocked, the check box is dimmed to show that the possibility of turning on the navigation indicators is not accessible. The system policy, canceling the navigation indicators and forbidding the manipulation of their enabled (disabled) state, is stored in the numeric value "NoChangeKeyboardNavigationIndicators". This value is stored in the "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" system registry key. This policy can be present either in HKEY_LOCAL_MACHINE hive and have the Local Machine range or HKEY_CURRENT_USER hive, with Current User range. When the conflict exists between the same policies with the Local Machine and Current User ranges, the system policy, stored in HKEY_LOCAL_MACHINE has the priority over the policy, stored in HKEY_CURRENT_USER hive. This policy state is represented with the pair of Boolean values: "1" and "0". The absence of value is equivalent to the state by default - "0", in other words, the disabled state of the policy.

Hide Appearance Page

This policy is applicable in all Windows versions and removes the Appearance page from the applet for Display settings in Control Panel after being enabled. It is stored in the numeric value "NoDispAppearancePage" of "Software\Microsoft\Windows\CurrentVersion\Policies\System" key in HKEY_CURRENT_USER hive. After appliance the Appearance page is hidden, and applet for Display settings can not be used for the customisation of colour or appearance scheme for the Desktop and windows.

A pair of Boolean values: "1" (enabled state) and "0" (disabled state) respond for representation of the policy. The absence of "NoDispAppearancePage" value means that the policy is not set or what is the same if it is in disabled state.

Hide Background Page

This policy works in all Windows versions and removes the Background page from the applet for Display settings in Control Panel after being set to the enabled state. The state of policy is stored in the "NoDispBackgroundPage" numeric value in "Software\Microsoft\Windows\CurrentVersion\Policies\System" key of HKEY_CURRENT_USER system registry hive. When this policy is in active state, the Background page is removed and applet for Display settings can not be used for the customisation of patterns or wallpapers for Desktop.

There can be in the value one of Boolean values: "1", i.e. the policy is enabled, or "0", when the policy is in disabled state. When the "NoDispBackgroundPage" value is absent in "Software\Microsoft\Windows\CurrentVersion\Policies\System" key, the applet for Display settings behaves in common way.

Hide Settings Page

This policy is applicable in all Windows versions and removes the Settings page from the applet for Display settings in Control Panel after being enabled applet for settings can not be used for the settings customisation of Display, video card, colour management. The numeric value "NoDispSettingsPage" of "Software\Microsoft\Windows\CurrentVersion\Policies\System" in HKEY_CURRENT_USER system registry hive responds for this policy state.

A pair of Boolean values: "1" (enabled state) and "0" (disabled state) respond for representation of two states of this policy. The absence of "NoDispSettingsPage" value is equivalent to its zero value state.

In order to see the state of above-mentioned policies or to manipulate them in Activity and Authentication Analyzer follow in the left navigation pane next way:

Computer Administration then Control Panel, later Display and find in the right list items corresponding to these policies named:

  • Hide Screen Saver Page
  • Disable UI to change menu animation setting
  • Disable UI to change keyboard navigation indicator setting
  • Hide Appearance Page
  • Hide Background Page
  • Hide Settings Page

Tuesday, July 30, 2002

Applications startup in Windows

mad hack
The article gives the systematisation of the places in the system registry and ini-files, which are for the placements of the application to be launched during Windows-system startup.

In «Komputernaya Gazeta» #10 (200) for 16 March 1999 I made my debut with the article «Breaking into Windows via registry». The talk in the article was about the places in the system registry, in initialization files, where the program can be registered to launch during the Windows boot. Since that time several new Windows versions have been released, new version have own features, and the amount of my knowledge has increased. It is high time to fill up the gaps.

The utility for system configuration MSConfig.exe

Beginning from Windows version 98, Microsoft supplies with utility «MSConfig.exe», which gives the convenient interface for management of files starting up while Windows boots. It is placed in Windows installation folder. One can launch it from «Run» dialog box. There is no option to add new item with the application or document name to start-up, but there is an option to turn off, not deleting, any of items present in the lists. There is another interesting option - to check the validity of the path corresponding to given start-up item, and to delete from the lists the items, which paths are not correct. In spite of the rather miserable functionality of this application, it fits for the users of system, but not for the administrators. I will refer to this utility under necessity further in the article.

Startup from the initialization files

The description of places for startup will be delivered in chronological order, beginning from the first Windows version and obsolete technologies. The initialization files were inherited from 16-bit Windows versions, Microsoft declared several times about getting rid of obsolete files, but up to now they are actually processed during boot.

There are two values in «Win.ini» file in «[windows]» section, which can be the place for startup. The first value is «load», the second one - «run». Their content «by default» is an empty string. The file names in them must contain no blanks; the composing of full file name in quotes is not admissible. In these values several file names can be enumerated by comma. Usually they are used for drivers loading, but can load «Trojan horses» or «keyboard spies».

Another initialization file, which can be used for applications startup is the «System.ini» file. There is a value «shell» in this file in «[boot]» section, which stores the name of Windows shell. The content «by default» of this value is «Explorer.exe». The value «shell» can contain the applications list for startup as command line parameters for «Explorer.exe». The «Explorer.exe» application processes the command line and tries to launch the applications or documents, enumerated in the command line. The requirements to the «shell» value format are the same as to above-mentioned values of «Win.ini» file. Last time this value is wide used for the network worms launch. This makes the localisation hard to reveal, as the administrators forget to check this value as a place for destructive applications startup.

«MSConfig.exe» utility allows checking the state and modifying the content of these three values: «load», «run», «shell», which are located in initialization files.

Startup folders

The first folder, which is worked through after the Windows booting finished, is the folder «StartUp», which can stores the list of applications or documents shortcuts (*.lnk). One can see its state, passed by the «Start» into the submenu «Programs». This is the folder, corresponding to the «Current User».

In order to find its location, one must to find in the system registry the «HKEY_CURRENT_USER \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\User Shell Folders» key storing the locations of all the changed folders and to search out the value «Startup» of string type. If the needed value is missing, that its location on hard drive «by default» is registered in the system registry in «Startup» value of «HKEY_CURRENT_USER \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\Shell Folders» key.

The utility for the system tuning «MSConfig.exe» shows the shortcuts to applications, which are located in «StartUp» folder. If any item is turned off using the «MSConfig.exe», that the folder named «Disabled Startup Items» will be created in «Programs» folder (it is the submenu in the «Start» menu), where «MSConfig.exe» will move the disabled item. In order to temporarily exclude the shortcut from the startup I resort to much simpler method: I set the attribute «hidden» on the needed shortcut and it will be omitted during the next booting.

The next folder is «Common» for all users - folder «StartUp» (Common Startup Folder), which is also processed after Windows booting to search for the shortcuts to documents or applications. One can see it in submenu «Start» in Windows NT or 2000. Its content is not shown in Windows 9.x, ME. It must store the shortcuts common for all users' profiles. This folder created for multi-users mode as reported in Microsoft documentation (MSDN). However, its content is processed, even Windows 95, 98, ME work in single-user mode.

The value «Common Startup» in «HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\User Shell Folders» system registry key, which store the locations of all the changed folders, stores its registered location on the hard drive. If this value is missing, one must search of this folder location «by default» in «Common Startup» in «HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion \Explorer\Shell Folders» key.

«MSConfig.exe» also shows the list of executables located in «Common» (general for all the users) «StartUp» folder. If using the «MSConfig.exe» turns off any item, the folder with name «Disabled Startup Items» will be created in the same, where the «Common StartUp» folder is located, folder, and the disabled item will be moved there.

The administrators are to pay attention to this folder content as to place of possible application startup.

System registry: startup, common for all Windows versions

There is the branch «SOFTWARE\Microsoft\Windows\CurrentVersion» in the Windows system registry containing several groups for applications startup. All these groups can be in the both HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive. The description is general; all can be extrapolated for both these hives. If Windows is used in multi-user mode, in other words, this is either Windows version NT/2000/XP, or 95, 98, ME with user profiles enabled, one must also search these groups in «HKEY_USERS\.Default» hive. This branch is common for all the users of system. If Windows 95, 98, ME work in single-user mode, the «HKEY_USERS\.Default» branch is identical to the HKEY_CURRENT_USER branch.

So then, I give the full paths to keys:
«SOFTWARE\Microsoft\Windows\CurrentVersion\Run»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices»,
«SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce»,
which can contain the string values with applications or documents names launching during the system starts. The «RunOnce» branch is not supported in Windows NT 3.5. The names of string values, which are located in these keys, can be arbitrary.

Further I deliver few rules, orientated on which one can better understand the process and the order of applications launch registered in those or other places for startup:

  1. The keys, located in HKEY_LOCAL_MACHINE hive, are processed earlier than corresponding keys, located in HKEY_CURRENT_USER hive.
  2. The content of «RunServices», «RunServicesOnce» system registry keys is processed earlier than values in «Run», «RunOnce» keys.
  3. The launch of «RunServices» and «RunServicesOnce» happens before the displaying of user logon dialog box, further goes asynchronously with logon dialog box and can continue after successful registration. The applications, registered in system registry values, located in «RunServices» and «RunServicesOnce» are launched asynchronously, and therefore there can be the situation when they work simultaneously.
  4. The launch of applications or documents, as it follows from the very name, registered in «RunOnce» and «RunServicesOnce» keys, happens one time irrespective whether it is successful or not. The value, located in «RunOnce» or «RunServicesOnce» key, is removed before the launch of application, which name it contains.
  5. The values, stored in «Run», «RunOnce» keys, are launched synchronously and in indefinite order, but only, when the content of «RunServices» and «RunServicesOnce» finishes loading.
The system registry keys are processed in the following order. At first, the «RunServices» and «RunServicesOnce» content of HKEY_LOCAL_MACHINE hive is processed. Further the logon dialog box for user registration in system appears. After this the operating system start processing the «RunOnce» and «Run» keys of HKEY_LOCAL_MACHINE hive, further «Run» of HKEY_CURRENT_USER hive. The items stored in «StartUp» folder are the next to get launched. After this is the turn of values in «RunOnce» key of HKEY_CURRENT_USER hive.

The list located in «RunServices» and «Run» keys, which automatically startup while Windows boots, can be controlled with the application for the system tuning «MSConfig.exe». If any item form the list is disabled, the «MSConfig.exe» will move this item to «RunServices-» or «Run-» correspondingly.

The «Setup» key, which can be stored in «RunOnce» key both in HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive, is worthy attention. This key is used by either the Windows Setup Wizard or «Add/Remove Programs» Wizard. While working through the values containing in this key, dialog box with the progress bar is displayed. The name of item is used as a name of item in dialog box. Analogously to the content «RunOnce» key, the item of the «RunOnce\Setup» are deleted and launched one time. Another system registry key, which is worthy attention, is «RunOnceEx». I will give the differences in launch for the values located in «RunOnceEx» and «RunOnce» from the launch of values located in system registry key «Run».

The values located in «RunOnceEx» key will not be launched. For the automatic processing the registry sub-key must be created in it and, this sub-key, which is to contain values with applications names. The keys and values located in «RunOnceEx» key are sorted in alphabetical order to force them to definite startup order compulsorily. In other words, the item higher by alphabet would be launched earlier, not depending when it was added to «RunOnceEx» key. The applications or scripts must either finish themselves or not require the definite action for finishing. While one item is not finished either further list processing stops or Windows booting stops waiting for compulsory terminating of the launched application. The separate processes are not created for the applications launched from «RunOnceEx» key in contrast to the «RunOnce» и «Run» keys.

«MSConfig.exe» application for the system tuning does not show the content of the keys «RunOnce», «RunOnceEx», «RunOnce\Setup» and «RunServicesOnce»

Startup features in Windows NT/2000/XP

As an addition to above-listed keys, the another key «Software\Microsoft\Windows NT\CurrentVersion \Windows\Run» is specific for Windows versions NT, 2000 and XP, which can be in hives LOCAL_MACHINE or HKEY_CURRENT_USER.

There can be two string values «Load» and «Run» in «Software\Microsoft\Windows NT\CurrentVersion \Windows» key, which can store the list of applications for automatic startup.

These values are analogies to values of the same name from the initialisation file «Win.ini». When Windows NT (2000) is installed over Windows 95, 98 the values content from section «[windows]» of «Win.ini» are transferred to the corresponding values of «Software\Microsoft\Windows NT\CurrentVersion\ Windows» key. If several files are registered in the value, their names must be separated with space chars. Therefore the path to file containing the space char can not be written to them, the quotation marks are not accepted. The content «by default» for these values is the space char. The programs, which launched from «Load» value, are minimised during launch.

Startup features in Windows ME/2000/XP

Windows versions has another one list for documents or applications startup, launching after the user registration in the system, which can be located both in HKEY_LOCAL_MACHINE hive and HKEY_CURRENT_USER hive. It is stored in string values of «Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\Run» key. The names of values for this key have one distinctive feature: they must be represented in the form of ordinal numbers, beginning at «1». The list located in HKEY_LOCAL_MACHINE hive will be processed before the list of HKEY_CURRENT_USER hive.

Startup while Windows Logon

The separate group Windows Logon for the control over the initialisation during the user registration appears in Windows NT and is developed further by Microsoft for Windows version 2000 and XP. The Winlogon values are located in the system registry in «SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon» key of HKEY_LOCAL_MACHINE hive. All the described in the article values, related to Winlogon, have the string type.

Shell value

The «Shell» value standing for the program shell, is present in the system registry branch «Winlogon» in Windows versions NT, 2000 and XP.

This string value determines the list of executable files providing the operating system with the user interface, and which must be launched together with the program shell.

«By default» Windows launches the programs, enlisted in «Userinit» value, located in «Winlogon» branch, and including very «Userinit.exe». If, by any reason, «Winlogon» process could not launch the programs defined in «Userinit» value, then «Winlogon» would directly go to process the executable files, which name are registered in «Shell» value.

The «value by default» of «Shell» can vary. This is «taskman, progman, wowexec» for Windows NT and «Explorer.exe» for Windows 2000, XP.

System value

This value is present in Windows versions NT, 2000 and XP. It contains the list of executable files launched by Winlogon in the system context during the system initialisation. This list can be varied by modification of this value.

The «value by default» is «lsass.exe, spoolss.exe» for Windows NT and «lsass.exe» for Windows 2000, XP. The note by Microsoft given in MSDN is interesting: «This entry appears in the registry, but it is not used by Windows».

VmApplet value

«VmApplet» value launching the «Control Panel» application for the system configuration is specific for Windows versions 2000 и XP.

It stores the list or one executable file, which is launched by Winlogon process to let user to adjust the virtual memory settings, if the system volume misses the paging swap-file. The file extensions for the file name are not obligatory.

The «value by default» for it is «rundll32 shell32, Control_RunDLL "sysdm.cpl"». One must not change the content of this value without need, because it can lead to the change of virtual memory settings in Windows 2000, XP.

Userinit value

«Userinit» (user initialization) is specific for Windows versions NT, 2000 and XP.

The content of this value contains the executables, which are launched by WinLogon process in user context, during the user registration in the system.

«By default» Winlogon launches «Userinit.exe», which is responsible for the launch of program shell, and executes the script files for registration, re-establishes the network connections and then launches the «Explorer.exe».

The «value by default» for «Userinit» is «userinit, nddeagnt.exe» for Windows NT, «userinit» for Windows 2000, XP. «nddeagnt.exe» application is necessary for the NetDDE launch - network dynamic data exchange.

The extensions in file name enumerated in this value are not obligatory.

One may change the content of this value by adding or removing the programs from the list. «Userinit.exe» can be changed to the name of one's own program, not having forgotten to include in application the code for «Userinit.exe» launch, if it is necessary to launch the application before the user interface together with the Windows «explorer» is loaded. Or make much simpler, creating the executable file for batch processing named «userinit.bat» with the list of programs for launch and registering in one of the lines the very «Userinit.exe» file.

P.S. These are administrators, but not hackers, who were addressed with the information, systematised in this article. The official Microsoft documentation contains in such or other form all the knowledge given in the article.

Valient Newman aka Black Prince


All of these was realised in Activity and Authentication Analyzer

Activity and Authentication Analyzer history

"Activity and Authentication Analyzer" takes into account what system policies and what histories of user activity are inherent in...