How to Completely Disable ‘Remote Registry’ Service via Group Policy in Windows 11

Windows 11 includes the “Remote Registry” service, a legacy administrative component that allows authorized remote users (and management software) to connect to the machine over the network and modify its Windows Registry. While historically useful for enterprise helpdesks and centralized configuration management tools (like SCCM), leaving the Remote Registry service running in modern, zero-trust environments presents a severe security vulnerability. If an attacker gains lateral movement within the network and compromises a privileged credential, an active Remote Registry service provides a direct vector to silently alter security policies, disable antivirus software, or establish persistence without ever executing a local payload on the target endpoint.

This guide explains how to completely disable the ‘Remote Registry’ service via Group Policy in Windows 11, neutralizing this lateral attack vector and enforcing strict local-only registry administration.

Disable Remote Registry via Group Policy

To enforce a strict block that disables the service globally across the OS and prevents users (even local administrators) from turning it back on, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Windows Settings > Security Settings > System Services

5. In the right-hand pane, locate the service named Remote Registry.
6. Double-click the policy to open its configuration window.
7. Check the box next to Define this policy setting.
8. Select the radio button next to Disabled. (By disabling this policy, we instruct the Windows Service Control Manager to lock the startup type to ‘Disabled’ and immediately terminate the service).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

System Service Group Policy changes require a reboot to cleanly apply the Service Control Manager locks.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force, then reboot the workstation. Post-reboot, log back in and press Windows Key + R, type services.msc, and press Enter. Scroll down to the Remote Registry service. You will see that the “Status” is blank (not running), and the “Startup Type” is permanently locked to Disabled. The operating system is now cryptographically bound to reject all inbound RPC requests attempting to read or modify the local registry, significantly hardening the endpoint against lateral network attacks.