1. 禁用regedit.exe
注册表键: HKCU/Software/Microsoft/Windows/CurrentVersion/Policies/System
注册表值: DisableRegistryTools
类型: REG_DWORD
值: 00000001
2.服务自启动
注册表键: HKLM/SYSTEM/CurrentControlSet/Services/KPDrvLN
注册表值: Start
类型: REG_DWORD
值: 00000003
3. 禁用注册表
注册表项:HKEY_CURRENT_USER/SOFTWARE/MICROSOFT/WINDOWS/CURRENTVERSION/POLICIES/SYSTEM/DISABLETASKMGR
修改 1 类型string
4. 删除安全模式相关注册表键值,导致用户无法正常进入安全模式:
HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}