The read-only bag of tricks
- Favorites menu = your audit landmarks — pin
HKCU\…\Run,…\StartupApproved,Control Panel\Desktoponce; return without typing. - Find (Ctrl+F) with “Keys” ticked only — hunts for vendor residue without values-and-data noise; entire sessions can be spent in Find mode, zero writes possible.
- Address bar accepts absolute paths: paste
HKCU\…\…from docs instead of click-walking and risk-dragging something.
Evidence moves for files that outlive you
File → Export on a selected key writes REG (text, reviewable). Export pre/post around any guided change lets diff tabs prove what moved. Regedit writes on export = none; view-risk = zero.
Rules of the careful
- Double-clicking is the only write hazard; default on keys is never single-click edit. Set your habit: read via right-pane “Data” column, confirm via modify dialog cancel-not-ok.
- If permission errors stop the read, the correct emotion is information: the key is protected for a reason. Log the boundary; don't conquer it.
- Never merge .reg from the internet; in audit-roadmap terms, that's running code you didn't read.