The redirect, kept simple
On x64 Windows, when a 32-bit process asks for HKLM\Software\Contoso, the registry redirector hands it HKLM\Software\Wow6432Node\Contoso. Reflection keeps each architecture's software inventory separate where bitness actually matters (file paths, COM registrations, driver interfaces).
Where you see it in audit work
HKLM\…\Run vs Wow6432Node\…\Run
32-bit machine startup entries redirect to the twin node
HKCU\Software\…
NOT redirected: no bit-split for per-account keys — ever
HKCR for 32-bit COM
redirected views of COM/ProgID registration, matching bitness of consumer
Practical audit posture
- Autoruns lists every entry with its bitness column — hide-32 masks exactly the class you mean by “newer entries.”
- Manual checks:
REG.EXE QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /reg:64vs/reg:32. The flags force the view instead of guessing which bitness your client chose. - Most per-user tuning: out of scope entirely — HKCU doesn't redirect, so per-account tool catalogs never inherit this complexity with them.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.