How to Disable the Remote Registry Service (CIS Check) Without Breaking Credentialed Scans

“Ensure ‘Remote Registry (RemoteRegistry)’ is set to ‘Disabled'” is a CIS benchmark check that fails when the Windows Remote Registry service has any startup type other than Disabled. The service lets authorized users read and change the registry over the network. Fix it by setting the startup type to Disabled through Group Policy or Set-Service, then stopping the service.

The catch is that remote credentialed vulnerability scans depend on this same service. This guide covers the fix, the scanner conflict, and how to handle both.

What the scanner is actually detecting

This is a configuration check, not a missing patch. The compliance audit authenticates to the host and reads the startup type of the RemoteRegistry service (display name “Remote Registry”). Anything other than Disabled fails, including Manual.

In Tenable’s audit library, this item comes from CIS profiles for Windows client operating systems: Windows 7, 8.1, 10 and 11, plus the CIS Intune benchmarks for Windows 10 and 11. Almost all of them are Level 2, and the benchmark’s rationale frames the setting as a measure for high security environments. None of the listed audits are Windows Server benchmarks, which matters later.

Plugins 35703 and 35704 are not vulnerabilities. They show up because the scan policy option that starts Remote Registry is turned on, and they are useful evidence of how your scanner reached the registry.

Real-world risk

Remote Registry answers requests on the winreg named pipe over SMB (TCP 445). It does not give anonymous access. The permissions on HKLMSYSTEMCurrentControlSetControlSecurePipeServerswinreg control who may connect, and two Security Options policies (“Network access: Remotely accessible registry paths” and “Network access: Remotely accessible registry paths and subpaths”) list paths that remain reachable. Microsoft notes that remote access to those paths also requires the Remote Registry service to be enabled.

The realistic exposure is post-authentication. With an administrator account, someone can read configuration, installed software and security settings from many machines without logging on to any of them, and change values remotely. What other accounts can reach depends on the winreg permissions and the allowed paths lists. Either way, it is a convenient channel for reconnaissance and lateral movement.

Keep the limits in mind. An attacker who already has administrator rights on the target can change the startup type back through the Service Control Manager, because sc.exe accepts a remote server name. Disabling the service reduces attack surface; it is not a security boundary. There is no unauthenticated exploit here, which is why CIS places it at Level 2.

Microsoft’s service guidance for Windows Server 2016 lists Remote Registry as Automatic with the recommendation “Do not disable”. On the client side, Tenable’s credentialed scan documentation says the service is disabled by default, and Microsoft’s performance counter documentation notes it was enabled by default before Windows Vista. A workstation that fails this check has usually been changed by imaging, a GPO or a management tool.

How to confirm it on the host

From an elevated PowerShell prompt:

Get-Service -Name RemoteRegistry | Select-Object -Property Name, StartType, Status
sc.exe qc RemoteRegistry
reg query "HKLMSYSTEMCurrentControlSetServicesRemoteRegistry" /v Start

The check passes only when StartType is Disabled, sc.exe shows START_TYPE : 4 DISABLED, and Start is 0x4. A value of 2 is Automatic and 3 is Manual.

If the value keeps coming back, find out what sets it. Check the applied GPOs, then look for Service Control Manager event 7040, which records startup type changes:

gpresult /scope computer /h C:Tempgp-computer.html
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Id=7040} -MaxEvents 200 |
    Where-Object Message -like '*Remote Registry*' |
    Select-Object TimeCreated, Message

How to fix it

Domain-joined workstations: Group Policy

1. Edit a GPO linked to the target computers and go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
2. Open Remote Registry, tick Define this policy setting, and select Disabled.
3. Run gpupdate /force on a test machine, or wait for the normal refresh.

The policy sets the startup type. If the service is running when the policy applies, stop it once (below) or let the next restart take care of it.

Standalone hosts or scripted rollout: PowerShell

Stop-Service -Name RemoteRegistry
Set-Service -Name RemoteRegistry -StartupType Disabled

The same with sc.exe, which also accepts a remote computer name such as \PC042 before the command:

sc.exe config RemoteRegistry start= disabled
sc.exe stop RemoteRegistry

The space after start= is required. On a domain-joined machine, a GPO that defines a different startup type overwrites manual changes at the next refresh, so fix the GPO instead.

Intune-managed devices

The SystemServices Policy CSP only covers a fixed list of services, and Remote Registry is not on it. Deploy the two PowerShell lines above as a platform script or a Remediations script running as SYSTEM.

If you run remote credentialed Nessus scans

This is where the fix collides with your scanner. Nessus reads the registry through this service, and Tenable documents on-demand starting for a service set to Manual. Microsoft’s sc.exe documentation states that a Disabled service cannot be started until its start type is changed. You have two defensible options:

• Enforce Disabled and scan locally. A scanner agent installed on the host reads the registry locally and does not need the Remote Registry service. This keeps the CIS item passing.
• Use Manual plus on-demand start. Set the startup type to Manual and enable Start the Remote Registry service during the scan under Credentials > Windows > Global Credential Settings in the scan policy. The scan account needs administrative rights to start the service. Nessus starts the service for the scan and stops it afterwards (plugins 35703 and 35704). The CIS check will still fail, because Manual is not Disabled, so record a documented exception for the hosts in scope.

For background on the trade-off, see credentialed vs uncredentialed scanning.

How to verify the fix and rescan

Check many hosts at once over WinRM:

Get-CimInstance -ClassName Win32_Service -Filter "Name='RemoteRegistry'" -ComputerName (Get-Content .hosts.txt) |
    Select-Object PSComputerName, StartMode, State

Expected result: StartMode Disabled and State Stopped on every host. Then rerun the CIS compliance scan and confirm the Remote Registry item shows PASSED. No reboot is needed for the rescan, since the audit reads the configured startup type.

Also check your next vulnerability scan of the same hosts. If the plugin “Microsoft Windows SMB Registry : Nessus Cannot Access the Windows Registry” appears, registry-based checks did not run and the host may look cleaner than it is. The guide on troubleshooting Windows credentialed scan failures covers the other causes.

What can break and how to roll back

• Remote credentialed vulnerability scans lose registry access, as described above.
• Configuration Manager (SCCM) and other remote administration tools that read the registry over the network. The CIS benchmark itself calls this out.
• Remote performance counters. Microsoft states that reading counter data from a remote computer requires the Remote Registry service on that computer. Microsoft suggests WMI as the better route for remote counters.
• Remote registry editing, such as reg query \hostHKLM… or Registry Editor’s Connect Network Registry.

Record the current startup type before you change anything, so you know what to restore. To roll back a manual change:

Set-Service -Name RemoteRegistry -StartupType Manual
Start-Service -Name RemoteRegistry

For a GPO rollout, change the policy value to the startup type you want (Manual or Automatic) and run gpupdate /force. Do not rely on undefining or unlinking the setting to restore the old value; set it explicitly and confirm with sc.exe qc.

Common false positive reasons

Genuine false positives are rare, because the check reads one well-defined value. When the result looks wrong, it is usually one of these:

• Stopped but not Disabled. The service is not running, but the startup type is Manual. The check fails by design.
• A client benchmark applied to servers. If a CIS workstation audit runs against Windows Server, this item fails on servers where Microsoft recommends leaving the service on. Fix the audit scope rather than the servers.
• GPO drift. Someone fixed it locally, and a GPO or management tool set it back. Event 7040 shows when.
• Stale results. The scan ran before the host picked up the GPO, or the host was offline during the refresh.

FAQ

Is stopping the Remote Registry service enough?

No. The check looks at the startup type. A stopped service set to Manual can still be started on demand, so it fails the audit.

Should I disable Remote Registry on Windows Server and domain controllers?

Microsoft’s Windows Server 2016 service guidance says not to disable it, and the CIS item appears in client benchmarks, not server ones. Treat servers through your Windows Server hardening checklist instead, and restrict who can reach port 445.

Will disabling it break my Nessus scans?

Remote credentialed scans need the service. Either scan with a local agent or use Manual plus the “Start the Remote Registry service during the scan” option and record an exception.

Do I need to reboot?

No. Stop the service and set the startup type; both take effect immediately.

Tracking this finding across many hosts

This item tends to appear on every workstation at once, and the fix has to be weighed against how you scan. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners, including Nessus (by uploading a .nessus export, not an automatic sync), and merges duplicates within each scanner, not across scanners. Its AI can write host-specific remediation scripts that run only after human approval, deployed by its agents on Windows endpoints, and it re-tests afterwards to confirm closure; per-finding retest is available for Nessus results.

Sources

• Tenable: 5.24 Ensure ‘Remote Registry (RemoteRegistry)’ is set to ‘Disabled’ (CIS Windows 11 Stand-alone v5.0.0 L2)
• Tenable: Nessus plugin 35703, SMB Registry : Start the Registry Service during the scan
• Tenable Docs: Enable Windows logins for local and remote audits
• Microsoft Learn: Security guidelines for system services in Windows Server 2016
• Microsoft Learn: Accessing remote counter data