Why would the Registry Editor opened in a very specific branch?

James Silver 1 Reputation point
2021-07-10T00:08:55.363+00:00

I was reading about the printnightmare stuff and I went ahead to check the registry to make sure everything was good. When I typed the regedit command it opened in Computer\HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\CTF\Assemblies but I have never used the editor on this machine. That looks odd to me. Should I do something else? I'm already concern.

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,758 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2021-07-10T00:31:33.547+00:00

    Generally goes to last open location, nothing to worry about, collapse the branches, navigate to Computer and next open should be at top level.

    113443-image.png

    --please don't forget to upvote and Accept as answer if the reply is helpful--

  2. Castorix31 81,741 Reputation points
    2021-07-10T07:35:02.653+00:00

    The last key is stored at :
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
    LastKey
    So an application could have set this value.

    0 comments
  3. Carl Fan 6,836 Reputation points
    2021-07-12T09:57:41.427+00:00

    Hi,
    When you start Regedit, it automatically opens the last key that was viewed. (Registry Editor in Windows XP saves the last viewed registry key in a separate location).
    And this registry is related to your system IME. So if you haven't change it, I consider some related application, command or script may produced the same effect.
    Hope this helps and please help to accept as Answer if the response is useful.
    Best Regards,
    Carl

    0 comments