Registry tweaking guide for Windows 7

YouTube · Unread post by **the_r3dacted** » 24 May 2024, 09:46

These are basically the suggested Registry and Autologger tweaks from Blackbird. Why I made this is because Blackbird makes some interesting recommendations that break some useful (to me at least) functionality. So I wanted to see what it does and give the user more information on what things do when making these tweaks. The registry tweaks are pretty safe compared to services, but I still suggest reading them before blindly applying the file.

This post will go over Registry settings in Windows 7 that you can disable for more performance, privacy, and security. This list is based off of our Windows 7 Updated v5 ISO.

1: Manual

These can't be batch applied. They will need to be manually applied by you. Open the Registry Editor by pressing the windows key, typing regedit, and pressing enter. To change these, you can search for the name, or navigate to the path they are in.

► Show Spoiler

2: Able to be batch applied (See attached .reg file)

► Show Spoiler

AntonyMan · Unread post by **AntonyMan** » 31 Jul 2026, 20:57

How to Searching a registry KEY through (admin) Command Prompt. (REG QUERY /?)

REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f SpyNetReporting

----------
How to get Registry Admin Owner & Permissions using Command Prompt & "SetACL.exe":

Download the "SetACL.exe", copy it where the Command Prompt or Batch file.cmd starts from.
1. Download, (extrat it if it's in .zip) and place it on Desktop.
Then Copy it to C:\Windows\System32 (by cmd or manually)
(eg.: copy "%UserProfile%\Desktop\SetACL.exe" "%SystemRoot%\System32\SetACL.exe")

2. Open a Command Prompt (as Administrator) and type the followings.

cd %SystemRoot%\System32

:: Here set the HKEY path (after the equal sign HKEY=here\place\the\path )
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet"

:: Take Owner
SetACL.exe -on %HKEY% -ot reg -actn setowner -ownr "n:Administrators" -rec Yes

:: Take Permissions
SetACL.exe -on %HKEY% -ot reg -actn ace -ace "n:Administrators;p:full" -rec Yes

Done! Now you can edit/rename or delete the KEY.

----------
How to Backup a registry KEY through (admin) Command Prompt. (REG EXPORT /?)

:: export the key as .reg file on Desktop directory.
reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet" "%UserProfile%\Desktop\SpyNetReporting(64).reg"

----------
How to change (by overwriting) a registry KEY through (admin) Command Prompt. (REG ADD /?)

reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v "SpyNetReporting" /t REG_DWORD /d 0 /f

YouTube · Unread post by **the_r3dacted** » 02 Aug 2026, 09:59

It's not like that, it's more that if I try to apply it through a reg file it fails with permission issue, however applying it through regedit has no issues. So idk what to do about it.

Unread post by **Duke** » 02 Aug 2026, 13:09

the_r3dacted wrote: ↑02 Aug 2026, 09:59 if I try to apply it through a reg file it fails with permission issue, however applying it through regedit has no issues. So idk what to do about it.

For the record, NirSoft to the rescue:
https://www.nirsoft.net/utils/advanced_run.html

To solve the .reg files issue it can be run through the Explorer context menu. And it can be very useful in many other cases

AntonyMan · Unread post by **AntonyMan** » 02 Aug 2026, 13:27

the_r3dacted wrote: ↑02 Aug 2026, 09:59 It's not like that, it's more that if I try to apply it through a reg file it fails with permission issue, however applying it through regedit has no issues. So idk what to do about it.

I tested it to my Win7U x64 and works without problems. I checked also manually from regedit to see if indeed worked and was ok.
What's the errors messages?

AntonyMan · Unread post by **AntonyMan** » 02 Aug 2026, 13:30

Try the following. (full automated... with prompt menu options.

)

Disable_Telemetry[W7].cmd
Based on op's the_r3dacted info.

The following battch needs the "SetACL.exe" to get Permissions.
Download the "SetACL.exe", copy it where the Command Prompt or Batch file.cmd starts from.
Download, (extrat it if it's in .zip) and place it on Desktop.
Then Copy it in the same directory with batch.

Save it as Disable_Telemetry[W7].cmd

Code: Select all

@echo off&mode.com 130,999&title Disable_Telemetry[W7]
SetLocal EnableExtensions EnableDelayedExpansion
:: Support any foreign language or ASCII character (Unicode)
%SystemRoot%\System32\chcp.com 65001 >nul

echo.&echo. Manage the following registry keys to disable Telemetry:
echo.&echo.EnableQueryRemoteServer  (REG_DWORD)
echo. - Querying or reporting to a Microsoft server for diagnostics. (aka telemetry)
echo.SpyNetReporting  (REG_DWORD)
echo. - SpyNet telemetry for Windows Defender.
echo.&echo.RestrictReceivingNTLMTraffic  (REG_DWORD)
echo.RestrictSendingNTLMTraffic  (REG_DWORD)
echo. - Opted to make it optional as it breaks accessing a SMB NAS.
echo.&echo.   Values will change only if the reg keys values are already existed.
echo.   (also will display info and will open in Windows Registry Editor)

:START
:: Prompt for options 
echo.&echo.=====================================================================
echo. Press a [key] to choose an option:
echo.[B]   to Backup a (.reg) file on Desktop. (Recomended just any case)
echo.[D]   to Disable by changing its reg vaues. (will display log info)
choice /c BD /n /m "Selected:"

if %errorlevel%==2 set "Option=Disable" & goto :DISABLE
if %errorlevel%==1 set "Option=Backup" & goto :BACKUP


:BACKUP
:: make forlder on Desktop for backups.
mkdir "%UserProfile%\Desktop\[REG-backup]_Diagnostics-Telemetry"
:: Set Log file path
set "Log=%UserProfile%\Desktop\[REG-backup]_Diagnostics-Telemetry"

echo.&echo.Backing up...

echo.&echo. - Querying or reporting to a Microsoft server for diagnostics. (aka telemetry)
echo.   EnableQueryRemoteServer (x64)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy"
call :Check_if_exist
reg export "!HKEY!" "!Log!\EnableQueryRemoteServer(64).reg"

echo.   EnableQueryRemoteServer (x86)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy"
call :Check_if_exist
reg export "!HKEY!" "!Log!\EnableQueryRemoteServer(86).reg"

echo.&echo. - SpyNet telemetry for Windows Defender.
echo.   SpyNetReporting (x64)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet"
call :Check_if_exist
reg export "!HKEY!" "!Log!\SpyNetReporting(64).reg"

echo.   SpyNetReporting (x86)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet"
call :Check_if_exist
reg export "!HKEY!" "!Log!\SpyNetReporting(86).reg"


echo.&echo.
echo. - Opted to make it optional as it breaks accessing a SMB NAS.
:: Checking first, show query, and Backup only IF existed
echo.&echo.RestrictReceivingNTLMTraffic  (REG_DWORD)
set "HKEY=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
reg query "!HKEY!" /f RestrictReceivingNTLMTraffic 2>&1
if %errorlevel%==1 reg query "!HKEY!" & goto :next1
reg export "!HKEY!" "!Log!\RestrictReceivingNTLMTraffic.reg"
:next1
echo.RestrictSendingNTLMTraffic  (REG_DWORD)
reg query "!HKEY!" /f RestrictSendingNTLMTraffic 2>&1
if %errorlevel%==1 reg query "!HKEY!" & goto :next2
reg export "!HKEY!" "!Log!\RestrictSendingNTLMTraffic.reg"
:next2

:: Open Windows Registry Editor on Specific HKEY
call :Open
goto :START


:DISABLE
echo.&echo.Disabling...

:: - These disable querying or reporting to a Microsoft server for diagnostics. (aka telemetry)

:: EnableQueryRemoteServer (x64)  default = 1
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy"
call :Check_if_exist and Get_Admin_Owner_Permissions
reg add "!HKEY!" /v "EnableQueryRemoteServer" /t REG_DWORD /d 0 /f

:: EnableQueryRemoteServer (x86)  default = 1
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy"
call :Check_if_exist and Get_Admin_Owner_Permissions
reg add "!HKEY!" /v "EnableQueryRemoteServer" /t REG_DWORD /d 0 /f

:: - These disable SpyNet telemetry for Windows Defender.

:: SpyNetReporting (x64)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet"
call :Check_if_exist and Get_Admin_Owner_Permissions
reg add "!HKEY!" /v "SpyNetReporting" /t REG_DWORD /d 0 /f

:: SpyNetReporting (x86)
set "HKEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet"
call :Check_if_exist and Get_Admin_Owner_Permissions
reg add "!HKEY!" /v "SpyNetReporting" /t REG_DWORD /d 0 /f


echo.&echo.
:: Prompt for optionals 
echo. - Opted to make it optional as it breaks accessing a SMB NAS.
echo.   Values will change only if the reg keys values are already existed.
echo.   (also will display info and will open in Windows Registry Editor)
set "HKEY=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"
echo.&echo.Press [C] to Continue
echo.Press [A] to Abort  (display info and open in regedit)
choice /c AC /n /m "Selected:"
if %errorlevel%==2 goto :Continue
if %errorlevel%==1 goto :Abort

:Abort
echo.&echo.[!HKEY!]
echo.&echo.RestrictReceivingNTLMTraffic  (REG_DWORD)
reg query "!HKEY!" /f RestrictReceivingNTLMTraffic 2>&1
echo.&echo.RestrictSendingNTLMTraffic  (REG_DWORD)
reg query "!HKEY!" /f RestrictSendingNTLMTraffic 2>&1
:: Open Windows Registry Editor on Specific HKEY
call :Open
goto :START

:Continue
:: Checking first, show query, and change/add only IF value existed
echo.&echo.RestrictReceivingNTLMTraffic  (REG_DWORD)
reg query "!HKEY!" /f RestrictReceivingNTLMTraffic 2>&1
if %errorlevel%==1 reg query "!HKEY!" & goto :next3
reg add "!HKEY!" /v "RestrictReceivingNTLMTraffic" /t REG_DWORD /d 2 /f

:next3
:: Checking first, show query, and change/add only IF value existed
echo.&echo.RestrictSendingNTLMTraffic  (REG_DWORD)
reg query "!HKEY!" /f RestrictSendingNTLMTraffic 2>&1
if %errorlevel%==1 reg query "!HKEY!" & goto :next4
reg add "!HKEY!" /v "RestrictSendingNTLMTraffic" /t REG_DWORD /d 2 /f

:next4
:: Open Windows Registry Editor on Specific HKEY
call :Open
goto :START


:Open Windows Registry Editor on Specific HKEY
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" /v LastKey /t REG_SZ /d "%HKEY%" /f
start "" "%SystemRoot%\regedit.exe" -m
exit /b

:Check_if_exist and Get_Admin_Owner_Permissions
reg query "!HKEY!" 2>&1
if %errorlevel%==0 (
	if !Option!==Backup echo. Making Backup:
	if !Option!==Disable goto :Get_Admin_Owner_Permissions
) else (
	echo."!HKEY!"
)
exit /b

:Get_Admin_Owner_Permissions
echo. Gaining Owner ^& Admin full Permissions...
   :: Take Owner
SetACL.exe -on "!HKEY!" -ot reg -actn setowner -ownr "n:Administrators" -rec Yes >nul 2>&1
   :: Take Permissions 
SetACL.exe -on "!HKEY!" -ot reg -actn ace -ace "n:Administrators;p:full" -rec Yes >nul 2>&1
exit /b

exit

----------------------------------------

Open a new process of Windows Registry Editor on specific HKEY

Unlike Windows 10, Windows 7 Registry Editor don't have address bar to browse.

So, use this little batch to "Open a new process of Windows Registry Editor on specific HKEY"
[*] Allows to have multiple regedit windows opened.)
[*] with "HKEY Path Correction" which removing quotes ("..."), brackets ([...]), and ROOTKEY abreviations (ex:HKCU).

Strongly recommended: Do Not ever hide the "File name extensions" (due to security reasons)
File menu > Tools > Folder Options... > View (tab) > Uncheck "Hide extensions for known file types"

OR from (Admin) Command Prompt to Registry:
:: Hide EXTENSIONS for known file types [Uncheck=0]
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 0 /f

Save it as "Open Windows Registry Editor on specific HKEY.cmd"

Code: Select all

@echo off&mode.com 130,13&title Open Windows Registry Editor on specific HKEY&color 3b
SetLocal EnableExtensions EnableDelayedExpansion
echo. Open a new process of Windows Registry Editor on specific HKEY.&echo.
echo. If prompt is left empty and [Enter] is pressed, it will Clear the "Last Key"
echo.  and will Open Registry Editor at "Computer" ROOTKEY.&echo.

echo. Note: Enable the Command Prompt "Edit Mode" to allow you to paste with R.Click.
echo.(R.Click Command Prompt Title bar ^> Properties ^> Options (tab) ^> check Edit Mode.)&echo.

:: Prompt
echo. Paste here the HKEY:
set /p "HKEY=Paste here the HKEY:" >nul

:: HKEY Path Correction
:: removing quotes ("), bracets ([]), and ROOTKEY abreviations (HKCU).
set HKEY=!HKEY:"=!
set HKEY=!HKEY:[=!
set HKEY=!HKEY:]=!
if "!HKEY:~0,9!" == "Computer\" (set "HKEY=!HKEY:~9!")
if "!HKEY:~0,4!" == "HKCR" (set "HKEY=HKEY_CLASSES_ROOT!HKEY:~4!")
if "!HKEY:~0,4!" == "HKCU" (set "HKEY=HKEY_CURRENT_USER!HKEY:~4!")
if "!HKEY:~0,4!" == "HKLM" (set "HKEY=HKEY_LOCAL_MACHINE!HKEY:~4!")
if "!HKEY:~0,3!" == "HKU" (set "HKEY=HKEY_USERS!HKEY:~3!")
if "!HKEY:~0,4!" == "HKCC" (set "HKEY=HKEY_CURRENT_CONFIG!HKEY:~4!")

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" /v LastKey /t REG_SZ /d "%HKEY%" /f
start "" "%SystemRoot%\regedit.exe" -m

::TEST
::"[Computer\HKCR\123\456\789 spaces _0]"
::echo !HKEY!
::pause
exit

Note: Enable the Command Prompt "Insert Mode" or/and "Edit Mode" to allow you to paste with R.Click.
R.Click Command Prompt Title bar > *Properties (and *Defaults) > Options (tab) > check Insert Mode or/and Edit Mode.
*Defaults applies to Default admin cmd. (System32)
*Properties applies to current cmd (corresponding to shortcut).

OR from (Admin) Command Prompt to Registry:
for *(Defaults) admin cmd:
reg add HKEY_CURRENT_USER\Console /v InsertMode /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Console /v QuickEdit /t REG_DWORD /d 1 /f