System-Wide DLL Protection Registry Locations

This article provides an overview of where Windows stores the active system-wide Dynamic Link Library (DLL) execution and loading protection settings within the Windows Registry (regedit.exe). It details the primary registry paths and values responsible for Safe DLL Search Mode, current working directory (CWD) execution restrictions, and DLL initialization security.

1. Safe DLL Search Mode Configuration

The primary protection mechanism preventing dynamic link library preloading attacks (DLL hijacking) is Safe DLL Search Mode. This setting reorders the dynamic search path to prioritize system directories over the current working directory.

Regedit records this configuration at: * Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager * Value Name: SafeDllSearchMode * Value Type: REG_DWORD * Values: * 1 = Enabled (Default in modern Windows versions; prioritizes %SYSTEMROOT%\System32 before the current working directory). * 0 = Disabled (Current working directory is checked earlier in the search hierarchy).

2. CWD-Based DLL Execution Protection (CWDIllegalInDllDirs)

Windows provides granular control over DLL execution from current working directories, network shares, and WebDAV locations via the CWDIllegalInDllDirs policy.

Regedit records this configuration at: * Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager * Value Name: CWDIllegalInDllDirs * Value Type: REG_DWORD * Values: * 0 = Standard search path (No restriction on current working directory). * 1 = Removes the current working directory from the DLL search path when loading from WebDAV/network locations. * 2 = Completely removes the current working directory from the search path for all standard DLL loads. * 0xFFFFFFFF = Disallows DLL loading from the current working directory under all conditions.

3. AppInit_DLLs Execution Control

To protect against unauthorized global DLL injection via the AppInit_DLLs infrastructure, Windows enforces signature requirements and execution controls.

Regedit records these configurations at: * Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows * Key Values: * LoadAppInit_DLLs (REG_DWORD): Set to 0 to disable the execution of dynamic libraries specified in the AppInit_DLLs key entirely. * RequireSignedAppInit_DLLs (REG_DWORD): Set to 1 to require code-signing verification for any dynamic link library loaded through this mechanism (enforced by default when Secure Boot is active).

4. Process Mitigation and Exploit Protection Options

System-wide binary and DLL mitigation options (such as Mandatory ASLR, Export Address Filtering, and Control Flow Guard) configured via Windows Security or PowerShell are stored across two locations: