Windows DLL Search Order Registry Settings

Windows controls system-wide dynamic link library (DLL) search path behaviors primarily through the Session Manager key in the Windows Registry. This article explains the exact registry locations and values used to define, secure, and customize how the operating system resolves and loads DLL files across all applications.

Primary DLL Search Path Registry Location

The core registry path governing system-wide DLL loading behavior is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

Within this key, several values dictate how Windows traverses directories to find requested DLL files.

1. Safe DLL Search Mode (SafeDllSearchMode)

Safe DLL Search Mode determines the order in which the current working directory is evaluated relative to system directories.

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
• Value Name: SafeDllSearchMode
• Type: REG_DWORD
• Values:
  • 1 (Enabled / Default): Moves the current working directory down the search order, prioritizing the system directory (System32) and Windows directory first.
  • 0 (Disabled): Places the current directory immediately after the application’s loading directory, increasing vulnerability to DLL hijacking.

2. Known DLLs (KnownDLLs)

The operating system checks a pre-approved list of core system libraries before initiating standard search path routines.

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
• Type: Subkey containing multiple REG_SZ entries
• Behavior: Any DLL defined here (such as kernel32.dll or user32.dll) is loaded directly from the system directory without searching alternative paths, preventing unauthorized overrides.

3. Restricting Current Working Directory DLL Loading (CWDIllegalInDllSearch)

To mitigate DLL preloading attacks, administrators can restrict dynamic library loading from WebDAV or local current working directories.

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
• Value Name: CWDIllegalInDllSearch
• Type: REG_DWORD
• Values:
  • 0 (Default): Uses standard DLL search logic.
  • 1: Removes the current directory from the search path if the directory is on a network share.
  • 2: Completely removes the current directory from the DLL search path for all loaded modules.

Application-Specific DLL Search Paths

In addition to system-wide search order flags, individual executable search paths are configured under the App Paths key:

• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\<ExecutableName.exe>
• Value Name: Path
• Type: REG_SZ or REG_EXPAND_SZ
• Behavior: Specifies dedicated directory paths appended to the process DLL search order when the named executable launches.