HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultPassword]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [AutoAdminLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [AutoLogonCount]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [ForceAutoLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [IgnoreShiftOverride]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DontDisplayLastUserName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DontDisplayLockedUserId]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [ShutdownWithoutLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnProvider]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnUser]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnSAMUser]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation [DisableStartupSound]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [ShowTabletKeyboard]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background [OEMBackground]
%windir%\system32\oobe\info\backgrounds [background*.jpg]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6f45dc1e-5384-457a-bc13-2cd81b0d28ed}\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8bf9a910-a8ff-457f-999f-a5ca10b4a885}\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{AC3AC249-E820-4343-A65B-377AC634DC09}\* [*]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultPassword]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [AutoAdminLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [AutoLogonCount]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [ForceAutoLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [IgnoreShiftOverride]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DontDisplayLastUserName]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DontDisplayLockedUserId]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [ShutdownWithoutLogon]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\* [*]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnProvider]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnUser]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [LastLoggedOnSAMUser]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation [DisableStartupSound]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI [ShowTabletKeyboard]
HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background [OEMBackground]
%windir%\system32\oobe\info\backgrounds [background*.jpg]