Remote Registry Editor
Browse and edit the Windows registry of an online agent straight from the console — walk the root hives, search for keys by name, read a key's values, and add, change, delete, or export values without opening a full remote-desktop session.
The Remote Registry Editor is a live tab on the agent details
screen, under System Manager. It lets an operator inspect and adjust the
registry of a managed Windows machine on demand: choose a hive, expand the key tree, select a key
to see its values, and make targeted changes — all against the agent as it runs right now. It is
a lightweight alternative to a full remote-desktop session when all
you need is to check or tweak a single setting, or capture a key as a .reg file.
The registry editor works entirely over the agent's existing secure connection — there is no remote-registry service to enable, no share, and no inbound port on the endpoint. Every request is answered by the agent itself, so the editor only ever reaches what the agent's own account can reach.
Opening the registry editor#
Open a Windows agent from the Dashboard or the agents list, then choose Registry under the System Manager heading in the agent-details side navigation. The Registry entry only appears for Windows machines; it is not shown for Linux agents.
The Registry tab is laid out as:
- A hive selector and a search box across the top, plus Refresh, Collapse All, and Export actions.
- A key tree on the left that expands keys on demand.
- A values panel on the right that lists the selected key's values (name, data type, and data) and hosts the add / edit / delete actions.
Who can use it#
The registry editor is restricted to the Operator and Admin roles. Helpdesk and read-only users do not see the System Manager section at all. This matches the other live, machine-changing tools such as the remote file browser and remote services control.
| Action | Minimum role |
|---|---|
| Browse keys, search, view values, add / edit / delete values, export a key | Operator |
See Roles & Permissions for the full role model.
Registry changes run with the privileges of the agent's own service account, which is
typically a high-privilege local account. Editing or deleting the wrong value can break
applications or the operating system, and there is no undo. Treat the registry editor like
direct regedit access on the machine and restrict the Operator/Admin roles
accordingly.
The agent must be online#
Every registry action is answered by the agent in real time, so the target agent must be Online. If the agent is offline the tab shows the banner "Agent is offline. Registry operations are not available." and add / edit / delete actions are blocked. If the machine is in maintenance mode the editor shows "Agent is in maintenance mode. Registry operations may be limited." as a reminder that the endpoint may be mid-change.
Choosing a hive#
The hive selector lets you start from any of the five standard Windows root hives. The tree then lists that hive's keys, which you expand on demand:
| Hive | Common use |
|---|---|
HKEY_LOCAL_MACHINE | Machine-wide settings, installed software, and services |
HKEY_CURRENT_USER | Settings for the profile the agent is running under |
HKEY_CLASSES_ROOT | File associations and COM/class registrations |
HKEY_USERS | Loaded user profiles by SID |
HKEY_CURRENT_CONFIG | The active hardware profile |
Browsing keys & values#
Click the arrow next to a key to expand it; child keys are loaded lazily, so the agent only reports a key's subkeys when you expand it and browsing a deep tree stays responsive. Selecting a key loads its values into the panel on the right, where each value shows:
| Column | Meaning |
|---|---|
| Value Name | The name of the value (the key's default value appears with an empty name) |
| Data Type | The registry data type, shown as a badge (see the type list below) |
| Value Data | The stored data, with a one-click copy action |
A key with no values shows "No values set for this key". Collapse All folds the tree back to the hive root, and Refresh re-reads the current key from the agent.
Searching for keys#
Type a term into the search box to find keys by name within the selected hive. The search runs on the agent, starting from the root of the current hive and matching against key names, and returns up to 100 results. Select a result to jump to that key and load its values. Clear the search to return to normal browsing.
Because a search walks the hive on the endpoint, it can take longer than a simple key expansion; the editor allows a search up to about two minutes before timing out. Narrow the term or pick a more specific hive if a search is slow or returns too many matches.
Adding, editing & deleting values#
With a key selected, use Add Value to create a value, the row's edit action to change one, or the row's delete action to remove one. The add/edit dialog asks for a Value Name, a Data Type, and the Value Data. The supported data types are:
| Type | Description |
|---|---|
REG_SZ | String |
REG_EXPAND_SZ | Expandable string (may contain environment-variable references) |
REG_BINARY | Binary data |
REG_DWORD | 32-bit number |
REG_QWORD | 64-bit number |
REG_MULTI_SZ | Multi-string |
Saving a value writes it to the agent immediately and the values panel refreshes to show the result. Deleting a value removes it from the live registry right away. Both operations are carried out by the agent against the running system, so they take effect at once and cannot be undone from within Athena.
The registry editor is for surgical, one-machine changes. To apply the same registry setting across many machines at once — with targeting, scheduling, and result tracking — use a software deployment step or a remote command instead of editing each agent by hand.
Exporting a key to .reg#
With a key selected, use Export to capture that key and its subkeys as a
standard .reg file. The agent generates the export and your browser downloads it (the
file name is derived from the key path). This is handy for grabbing a known-good configuration
from one machine, keeping a record before you make a change, or preparing a value to reuse
elsewhere. Export is disabled until you have selected a key.
Timeouts#
The editor is built for interactive use and applies practical timeouts so a single request can't stall the console:
| Operation | Behaviour |
|---|---|
| List subkeys / read values / add / edit / delete a value | Times out if the agent does not respond within about 30 seconds |
| Search a hive | Allowed up to about 2 minutes; returns up to 100 matching keys |
| Export a key | Allowed up to about 2 minutes to accommodate larger key trees |
Troubleshooting#
| What you see | What it means |
|---|---|
| No Registry entry under System Manager | The agent is a Linux machine (registry is Windows-only), or your role is below Operator. |
| "Agent is offline. Registry operations are not available." | The agent is not Online. The editor needs a live connection — wait for the agent to reconnect. |
| "Agent is in maintenance mode. Registry operations may be limited." | The machine is in maintenance mode; changes may be affected by work in progress. |
| A key shows an error instead of its values or subkeys | The agent's service account likely lacks permission to read that part of the registry. |
| A search returns nothing or times out | No key name matched, or the hive is large — narrow the term or choose a more specific hive. |
The registry editor is a console feature reached through the agent-details screen; it is not exposed as a standalone REST endpoint or PowerShell cmdlet. To change registry settings across many machines at scale, script it with Software Deployment or remote commands via the PowerShell module.