Worklet for making HKEY_LOCAL_MACHINE registry changes

Hey @SomeITGuy - Yes! And there is an example of enforcing changes to HKLM in our KB for your reference: https://support.automox.com/help/enforce-windows-registry-settings-worklet

Ok, Looking to make quick on/off changes for DCOM testing in anticipation for June.

This link does not work, do you have a new link to try?  I need to do a couple reg add commands to fix cve-2022-0001

Hey there,

Thanks for flagging the broken link — that KB article was retired when we moved worklets into the Worklet Catalog inside the console. Apologies for the dead end!

IFor what you're trying to do (CVE-2022-0001 / Spectre v2 BHI mitigation on Intel CPUs), here's the path forward:

Starting Point

The Windows - System Preferences - Modify HKEY_USERS worklet in the Worklet Catalog is a solid template. Though, you'll just need to adjust it to target HKLM instead of HKEY_USERS for these registry keys.
 

Registry Changes for CVE-2022-0001

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0x00800000 /f



reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 0x00000003 /f

Reference Material

• Microsoft MSRC — CVE-2022-0001
• NVD — CVE-2022-0001
• Neowin — Microsoft's official registry tweak for Spectre on Intel

Tip 💡

This is also a great use case for Otto AI — you can have it refactor the HKEY_USERS template to HKLM and wire in the two registry values above in seconds, rather than editing by hand.

Let us know if you'd like a hand validating the evaluation code once you've built it out!

Best regards,
Angelo 

Hi,

We have a few templates in the catalog already setup for 32- or 64-bit registry modifications in HKLM specifically:
https://console.automox.com/manage/worklet-catalog/f1257fae-c0ad-59f8-967d-d279647fc44b

AI is always help to get this put together quick.

Regards,

Mark

Good call Mark!

Best regards,
Angelo