Modify or restore Registry settings on Endpoints

Use SIR capabilities to create, edit, delete, or restore registry keys on managed endpoints.

Important

An incorrect registry change can cause serious issues, such as preventing your system from starting or requiring you to reinstall software.
The "Restore" function can cause issues if another program has updated the registry between the time of backup and the restore operation. Use this feature with extreme caution.
System Information Reporter (SIR) automatically backs up registry entries before making any changes. If something goes wrong, you can use a SIR policy to restore the registry from the backup.

Create a Set Registry policy
Create a policy in the ePO Policy Catalog that contains required registry modifications.
1. Navigate to Menu → Systems → Policy Catalog. The Policy Catalog page is displayed.
2. Select System Information Reporter as the Product and Registry General as the Category.
3. Click New Policy.
4. In the policy window, enter a name for the policy and click OK.
  You can also choose to duplicate an existing policy from the drop-down list. The new policy window for System Information Reporter is displayed.

Configure the registry modification

Define the specific registry changes you want to make, that includes creating a mandatory backup.

In the policy window, on the Set Registry tab, enter a name for the Registry Backup File Name.
SIR creates a backup of any keys before it modifies them. You cannot modify, delete, or create registry keys without first specifying a backup name. The system saves the last 20 backups, and automatically deletes the oldest one.
Note
System Information Reporter automatically creates a backup of registry keys at %PROGRAMDATA%\McAfee\System Information Reporter\\RegistryBackup\ before enforcing any changes. This allows you to recover from any damage caused by the modification.
Enter the policy name and select a registry key, enter its value, select the value type.

Select a registry value type from the drop-down list (For example, REG_DWORD, REG_SZ) and enter its corresponding data. For example, for the key HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\lpc, you can specify the data.

Use this table to select the correct registry value type:

Registry Value Type	Description
REG_DWORD	A four-bytes-long decimal data. For example, `1234`.
REG_SZ	A fixed-length string. For example, `\\.\pipe\ma_named_pipe901122864`.
REG_MULTI_SZ	A multiple string. This value contains multiple lines. For example: `AVEngine C:\Program Files\Common Files\McAfee\Engine\`.
REG_BINARY	A variable-length binary data represented in hexadecimal format. For example, `29b5ce01`. Note Hexadecimal numbers are not case-sensitive.
REG_EXPAND_SZ	A variable-length data string. This data type includes variables that are resolved when a program or service uses the data. For example, System Information Reporter.

Under Action, you can:
- Create: Creates a new registry key, value, or data.
- Overwrite existing: Overwrites an existing key or value.
- Delete: Deletes a registry key, value, or data.

Restore a Registry from a backup.
You can restore the registry using a backup file that was created earlier.
1. Navigate to Menu → Systems → Policy Catalog.
2. Locate the required registry (on the Set Registry tab) policy that you previously created and click Edit.
3. Navigate to the Registry Restore tab.
4. From the list of available backups under Select the file to restore, select the backup file you wish to restore. The list shows each file's name and creation date.
5. Click Save. The restore action occurs at the next policy enforcement.