Registry keys

[Justin Fitzgibbon]

More information here

https://auditqi.miraheze.org/wiki/AuditQi_Knowledgebase

Select Tracking type Registy Value

Note LM, HKLM, HKEY_LOCAL_MACHINE are all interchangable

Any paths including WOW6432 are for 64 bit operating systems remove for a 32 bit OS.

Current user MS User CID / Microsoft cloud account ID of current user = CU\SOFTWARE\Microsoft\Windows\CurrentVersion\Census\MSACIDs

Windows 10 build version (important for support) = LM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx

MS Office version (clicktorun) = LM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration\VersionToReport

7Zip = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{23170F69-40C1-2702-0920-000001000000}\DisplayVersion

Classic Shell = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{383BB30A-B4A7-4666-9A83-22CFA8640097}\DisplayVersion

Internet explorer version = LM\SOFTWARE\Microsoft\Internet Explorer\Version

Google Chrome = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{BE40B3E0-129E-313C-B663-94C192C5143F}\DisplayVersion

Acrobat Reader DC last update = LM\SOFTWARE\WOW6432Node\Adobe\AcrobatReader\DC\Installer\InstallDate
Acrobat Reader Version = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayVersion

Java version = LM\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment\BrowserJavaVersion

Path of mapped drive G = CU\Network\g\RemotePath

Users proxy server = CU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer

Silverlight version = HKLM\SOFTWARE\Microsoft\Silverlight\Version

Windows media player = LM\SOFTWARE\Microsoft\Active Setup\Installed Components{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version

Ifranview = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IrfanView\DisplayVersion

Windows Defender AV signature = LM\SOFTWARE\Microsoft\Windows Defender\Signature Updates\AVSignatureVersion

CryptoPrevent = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1\DisplayVersion

Intel Network connections = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PROSetDX\DisplayVersion

iTunes = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{9946A4F7-E0FD-4A33-82D1-06CBFFBBB9F9}\DisplayVersion

Update services = LM\SOFTWARE\Microsoft\Update Services\Server\Setup\VersionString

IIS version = HKEYLOCALMACHINE\SOFTWARE\Microsoft\InetStp\VersionString

Flash Player = LM\SOFTWARE\Macromedia\FlashPlayer\CurrentVersion

GPO applied ? = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\4\Version

iTunes = HKEYLOCALMACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Version

Windows 10 peer to peer enabled = LM\SOFTWARE\Policies\Microsoft\Peernet\Disabled

WSUS update server = LM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer

MySQL ODBC = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{75E9C88D-3B4E-44A7-967F-AE22A210167C}\DisplayVersion

Google Drive = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{D7269C20-B3CE-4CD0-8E88-3D307D3BD41A}\DisplayVersion

Google Drive path = HKCU\SOFTWARE\Google\Drive\Path

Notepad ++ = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++\DisplayVersion
Teamviewer = LM\SOFTWARE\WOW6432Node\TeamViewer\UpdateVersion
Teamviewer Client ID = LM\SOFTWARE\Wow6432Node\TeamViewer\ClientID
Teamviewer User = HKCU\SOFTWARE\TeamViewer\Meeting_UserName

VLC = LM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayVersion

Current PC domain or workgroup = LM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain

Component Based Servicing ie Windows update Last Modified date = LM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\LastModified_UTC