---
title: "Modify or restore Registry settings on Endpoints"
slug: "modify-or-restore-registry-settings-on-endpoints-1"
updated: 2026-10-26T07:33:44Z
published: 2026-10-26T07:33:44Z
canonical: "docs.trellix.com/modify-or-restore-registry-settings-on-endpoints-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Modify or restore Registry settings on Endpoints

Use SIR capabilities to create, edit, delete, or restore registry keys on managed endpoints.

### Important

- An incorrect registry change can cause serious issues, such as preventing your system from starting or requiring you to reinstall software.
- The "Restore" function can cause issues if another program has updated the registry between the time of backup and the restore operation. Use this feature with extreme caution.
- System Information Reporter (SIR) automatically backs up registry entries before making any changes. If something goes wrong, you can use a SIR policy to restore the registry from the backup.

1. Create a **Set Registry** policy

Create a policy in the ePO **Policy Catalog** that contains required registry modifications.

  1. Navigate to Menu → Systems → Policy Catalog. The **Policy Catalog** page is displayed.
  2. Select **System Information Reporter** as the **Product** and **Registry General** as the **Category**.
  3. Click **New Policy**.
  4. In the policy window, enter a name for the policy and click OK.

You can also choose to duplicate an existing policy from the drop-down list. The new policy window for System Information Reporter is displayed.
2. Configure the registry modification

Define the specific registry changes you want to make, that includes creating a mandatory backup.

  1. In the policy window, on the **Set Registry** tab, enter a name for the **Registry Backup File Name**.

SIR creates a backup of any keys before it modifies them. You cannot modify, delete, or create registry keys without first specifying a backup name. The system saves the last 20 backups, and automatically deletes the oldest one.

### Note

System Information Reporter automatically creates a backup of registry keys at **%PROGRAMDATA%\McAfee\System Information Reporter\\RegistryBackup\** before enforcing any changes. This allows you to recover from any damage caused by the modification.
  2. Enter the policy name and select a registry key, enter its value, select the value type.
  3. Select a registry value type from the drop-down list (For example, **REG_DWORD**, **REG_SZ**) and enter its corresponding data. For example, for the key `HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\lpc`, you can specify the data.

Use this table to select the correct registry value type:

| Registry Value Type | Description |
| --- | --- |
| REG_DWORD | A four-bytes-long decimal data. For example, `1234`. |
| REG_SZ | A fixed-length string. For example, `\\.\pipe\ma_named_pipe901122864`. |
| REG_MULTI_SZ | A multiple string. This value contains multiple lines. For example: `AVEngine C:\Program Files\Common Files\McAfee\Engine\`. |
| REG_BINARY | A variable-length binary data represented in hexadecimal format. For example, `29b5ce01`. ### Note Hexadecimal numbers are not case-sensitive. |
| REG_EXPAND_SZ | A variable-length data string. This data type includes variables that are resolved when a program or service uses the data. For example, System Information Reporter. |
  4. Under **Action**, you can:

    - **Create**: Creates a new registry key, value, or data.
    - **Overwrite existing**: Overwrites an existing key or value.
    - **Delete**: Deletes a registry key, value, or data.
3. Restore a Registry from a backup.

You can restore the registry using a backup file that was created earlier.

  1. Navigate to Menu → Systems → Policy Catalog.
  2. Locate the required registry (on the **Set Registry** tab) policy that you previously created and click **Edit**.
  3. Navigate to the **Registry Restore** tab.
  4. From the list of available backups under **Select the file to restore**, select the backup file you wish to restore. The list shows each file's name and creation date.
  5. Click **Save**. The restore action occurs at the next policy enforcement.

: