Anydesk - Regedit

[HKCU\Software\AnyDesk] "ui.confirm_connection"=dword:00000000 AnyDesk becomes a silent backdoor if also password-protected. 3.4 Custom UI Branding (White Label) Resellers and custom builds can change the displayed name:

Always audit HKLM\SOFTWARE\AnyDesk and HKCU\Software\AnyDesk on sensitive systems. A single DWORD change can turn a legitimate tool into a silent gateway. regedit anydesk

Date: April 14, 2026 Subject: Manipulating AnyDesk via Windows Registry for IT Administration, Security Hardening, and Forensic Discovery 1. Executive Summary AnyDesk, a popular remote desktop tool, stores most of its configuration not in plain-text .conf files, but within the Windows Registry (under HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE ). While the GUI offers standard settings, regedit reveals hidden switches, security bypass potentials, and enterprise lockdown capabilities. This report explores how modifying these keys can transform AnyDesk from a simple remote tool into a deployable asset—or a potential security loophole. 2. The Golden Path: Registry Locations | Scope | Registry Path | |-------|----------------| | User-specific settings | HKCU\Software\AnyDesk | | System-wide (admin) | HKLM\SOFTWARE\AnyDesk | | Legacy/older versions | HKLM\SOFTWARE\WOW6432Node\AnyDesk (for 32-bit on 64-bit OS) | 3. Interesting Registry Tweaks & Use Cases 3.1 Silent Installation & Pre-configuration (Enterprise) Instead of answering GUI prompts, IT admins can pre-set the client ID and alias: [HKCU\Software\AnyDesk] "ui

[HKLM\SOFTWARE\AnyDesk] "ClientID"="your-company" "alias"="IT-Helpdesk-01" AnyDesk launches pre-named, ready for remote connection without manual input. 3.2 Force Password for Unattended Access (Security) Without the GUI, you can enforce a fixed password: Date: April 14, 2026 Subject: Manipulating AnyDesk via

[HKLM\SOFTWARE\AnyDesk] "password"="SHA256_HASH_OF_PASSWORD" "salt"="RANDOM_SALT" Interesting note: AnyDesk stores a salted SHA256 of the password, not plaintext—but reversing is possible with enough compute power. By default, a remote user must accept incoming connections. This key bypasses it: