윈도우 포럼 - 스크린 샷 - 선우님 보시와요~~ㅋㅋ

스크린 샷

글 수 7,287

제목 : 선우님 보시와요~~ㅋㅋ

OldMaC

정리가 되지않아 중복되는 레지들이 있으니 그려러니하면서 넘어가 주세요.

정식으로 포스팅할 때는 정리할테니.... 근데 언제할지 미지수 입니다. ^^;

Dism++에서 선우님 Wim 파일을 G:\01 폴더에 마운트한 상태이고,

하이브로드도 Dism++에서 레지들을 추출한 상태이니 하이브경로는 바꾸어 작업하시면됩니다.

1. 빌드할 때 어드민계정 포함과 미포함 2가지를 만들어 어드민 계정에 부족한 레지들 추출

- 이 부분이 없으면 어드민계정 부팅이 안되니 기본적으로 추가시겨 주어야합니다.

하이브 경로...

{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SOFTWARE

-------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"DSCAutomationHostEnabled"=dword:00000002
"EnableCursorSuppression"=dword:00000001
"EnableFullTrustStartupTasks"=dword:00000002
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableUwpStartupTasks"=dword:00000002
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"SupportFullTrustStartupTasks"=dword:00000001
"SupportUwpStartupTasks"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000

;어드민계정으로 가능하게 해주는 레지 부분
;[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
;"DefaultUserName"="Administrator"
;"EnableSIHostIntegration"=dword:00000000
;"Userinit"="X:\\Windows\\system32\\userinit.exe,PECMD.EXE MAIN -user X:\\windows\\System32\\SwitchToAdminLogon.ini,"
;"AutoAdminLogon"=dword:00000001
;"DefaultPassword"=""

;[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts]

;[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
;"Guest"=dword:00000000

-------------------------------------

하이브 경로....

{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\gpsvc]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,4d,00,75,00,70,00,\
00,00,00,00
"Description"="@gpapi.dll,-113"
"DisplayName"="@gpapi.dll,-112"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
"Group"="ProfSvc_Group"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\
00
"ObjectName"="LocalSystem"
"PreshutdownTimeout"=dword:000dbba0
"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\
00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
65,00,00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,00,65,00,4f,00,77,00,\
6e,00,65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,\
73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,\
50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,\
65,00,63,00,75,00,72,00,69,00,74,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,\
4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,50,00,\
65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,\
00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,\
6f,00,77,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,4c,00,6f,00,61,00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,\
50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,\
00,65,00,73,00,74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,\
65,00,67,00,65,00,00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,\
72,00,65,00,61,00,74,00,65,00,50,00,61,00,67,00,65,00,66,00,69,00,6c,00,65,\
00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"Start"=dword:00000003
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\gpsvc\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
67,00,70,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="GroupPolicyClientServiceMain"

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\gpsvc\Security]
"Security"=hex:01,00,14,80,8c,00,00,00,98,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,c0,14,00,02,00,0d,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,5c,00,04,00,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,8d,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,01,00,00,00,00,\
00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\gpsvc\TriggerInfo]

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\gpsvc\TriggerInfo\0]
"Action"=dword:00000001
"Data0"=hex:32,00,45,00,42,00,30,00,38,00,45,00,33,00,45,00,2d,00,36,00,33,00,\
39,00,46,00,2d,00,34,00,66,00,62,00,61,00,2d,00,39,00,37,00,42,00,31,00,2d,\
00,31,00,34,00,46,00,38,00,37,00,38,00,39,00,36,00,31,00,30,00,37,00,36,00,\
00,00
"DataType0"=dword:00000002
"GUID"=hex:67,d1,90,bc,70,94,39,41,a9,ba,be,0b,bb,f5,b7,4d
"Type"=dword:00000006

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\seclogon]
"DisplayName"="@%SystemRoot%\\system32\\seclogon.dll,-7001"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,00,\
79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,\
00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,6e,00,65,00,\
74,00,73,00,76,00,63,00,73,00,00,00
"Start"=dword:00000003
"Type"=dword:00000020
"Description"="@%SystemRoot%\\system32\\seclogon.dll,-7000"
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,00,\
69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,\
00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,\
6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,\
61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\seclogon\Parameters]
"ServiceDll"=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,\
00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,65,00,63,00,6c,00,\
6f,00,67,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="SvcEntry_Seclogon"

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\seclogon\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,70,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,dd,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,cd,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,dd,01,\
02,00,01,01,00,00,00,00,00,05,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\TrustedInstaller]
"BlockTime"=dword:00002a30
"BlockTimeIncrement"=dword:00000384
"Description"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-101"
"DisplayName"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-100"
"ErrorControl"=dword:00000001
"FailureActions"=hex:84,03,00,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
"Group"="ProfSvc_Group"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,65,00,72,00,76,00,69,00,63,00,69,00,6e,00,67,00,5c,\
00,54,00,72,00,75,00,73,00,74,00,65,00,64,00,49,00,6e,00,73,00,74,00,61,00,\
6c,00,6c,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="localSystem"
"PreshutdownTimeout"=dword:0036ee80
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\ControlSet001\Services\TrustedInstaller\Security]
"Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,34,00,00,00,02,\
00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02,00,00,00,00,00,05,20,00,\
00,00,20,02,00,00,02,00,5c,00,04,00,00,00,00,02,14,00,ff,01,0f,00,01,01,00,\
00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,02,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,\
00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\gpsvc]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,4d,00,75,00,70,00,\
00,00,00,00
"Description"="@gpapi.dll,-113"
"DisplayName"="@gpapi.dll,-112"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
"Group"="ProfSvc_Group"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\
00
"ObjectName"="LocalSystem"
"PreshutdownTimeout"=dword:000dbba0
"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\
00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
65,00,00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,00,65,00,4f,00,77,00,\
6e,00,65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,\
73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,\
50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,\
65,00,63,00,75,00,72,00,69,00,74,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,\
4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,50,00,\
65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,\
00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,\
6f,00,77,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,4c,00,6f,00,61,00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,\
50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,\
00,65,00,73,00,74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,\
65,00,67,00,65,00,00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,\
72,00,65,00,61,00,74,00,65,00,50,00,61,00,67,00,65,00,66,00,69,00,6c,00,65,\
00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"Start"=dword:00000003
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\gpsvc\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
67,00,70,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="GroupPolicyClientServiceMain"

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\gpsvc\Security]
"Security"=hex:01,00,14,80,8c,00,00,00,98,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,c0,14,00,02,00,0d,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,5c,00,04,00,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,8d,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,01,00,00,00,00,\
00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\gpsvc\TriggerInfo]

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\gpsvc\TriggerInfo\0]
"Action"=dword:00000001
"Data0"=hex:32,00,45,00,42,00,30,00,38,00,45,00,33,00,45,00,2d,00,36,00,33,00,\
39,00,46,00,2d,00,34,00,66,00,62,00,61,00,2d,00,39,00,37,00,42,00,31,00,2d,\
00,31,00,34,00,46,00,38,00,37,00,38,00,39,00,36,00,31,00,30,00,37,00,36,00,\
00,00
"DataType0"=dword:00000002
"GUID"=hex:67,d1,90,bc,70,94,39,41,a9,ba,be,0b,bb,f5,b7,4d
"Type"=dword:00000006

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\seclogon]
"DisplayName"="@%SystemRoot%\\system32\\seclogon.dll,-7001"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,00,\
79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,\
00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,6e,00,65,00,\
74,00,73,00,76,00,63,00,73,00,00,00
"Start"=dword:00000003
"Type"=dword:00000020
"Description"="@%SystemRoot%\\system32\\seclogon.dll,-7000"
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,00,\
69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,\
00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,\
6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,\
61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\seclogon\Parameters]
"ServiceDll"=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,\
00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,65,00,63,00,6c,00,\
6f,00,67,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="SvcEntry_Seclogon"

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\seclogon\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,70,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,dd,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,cd,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,dd,01,\
02,00,01,01,00,00,00,00,00,05,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\TrustedInstaller]
"BlockTime"=dword:00002a30
"BlockTimeIncrement"=dword:00000384
"Description"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-101"
"DisplayName"="@%SystemRoot%\\servicing\\TrustedInstaller.exe,-100"
"ErrorControl"=dword:00000001
"FailureActions"=hex:84,03,00,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
"Group"="ProfSvc_Group"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,65,00,72,00,76,00,69,00,63,00,69,00,6e,00,67,00,5c,\
00,54,00,72,00,75,00,73,00,74,00,65,00,64,00,49,00,6e,00,73,00,74,00,61,00,\
6c,00,6c,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="localSystem"
"PreshutdownTimeout"=dword:0036ee80
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Services\TrustedInstaller\Security]
"Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,34,00,00,00,02,\
00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02,00,00,00,00,00,05,20,00,\
00,00,20,02,00,00,02,00,5c,00,04,00,00,00,00,02,14,00,ff,01,0f,00,01,01,00,\
00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,02,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,\
00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00

2. 시스템계정에서 어드민계정으로 전환하면 System32 폴더에 "SwitchToAdmin.log" 파일과 "SwitchToAdminLogon.log"이 생길 것입니다.

- 이놈 2가지를 살펴보면 부팅에 필요한 정보가 숨겨져 있어서, 저는 이놈들로 부팅요소를 찾았습니다.

- 하이브 경로들은 바로 알아 볼 수 있죠?

시스템계정_부팅영역.png

- RunOnce.reg 부분 추가.....

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Users/Default/ntuser.dat\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"PinTool"=hex(2):50,00,69,00,6e,00,54,00,6f,00,6f,00,6c,00,2e,00,65,00,78,00,\
65,00,20,00,2d,00,64,00,65,00,62,00,75,00,67,00,20,00,25,00,57,00,69,00,6e,\
00,64,00,69,00,72,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
32,00,5c,00,57,00,69,00,6e,00,31,00,30,00,50,00,45,00,2e,00,63,00,66,00,67,\
00,00,00
"Autorun"="Autorun.exe"
"PENetwork"=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,\
69,00,76,00,65,00,25,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,50,00,45,00,4e,00,65,00,74,00,77,00,\
6f,00,72,00,6b,00,5c,00,50,00,45,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,\
00,2e,00,65,00,78,00,65,00,22,00,00,00

RunOnce.reg부분.png

- Session Manager.reg 부분 추가.....

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):6c,00,6f,00,61,00,64,00,57,00,6f,00,57,00,36,00,34,00,2e,\
00,65,00,78,00,65,00,00,00,61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,\
6b,00,20,00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2f,00,6b,00,3a,\
00,43,00,20,00,2f,00,6b,00,3a,00,44,00,20,00,2f,00,6b,00,3a,00,44,00,20,00,\
2f,00,6b,00,3a,00,45,00,20,00,2f,00,6b,00,3a,00,46,00,20,00,2f,00,6b,00,3a,\
00,47,00,20,00,2f,00,6b,00,3a,00,48,00,20,00,2f,00,6b,00,3a,00,49,00,20,00,\
2f,00,6b,00,3a,00,4a,00,20,00,2f,00,6b,00,3a,00,4b,00,20,00,2f,00,6b,00,3a,\
00,4c,00,20,00,2f,00,6b,00,3a,00,4d,00,20,00,2f,00,6b,00,3a,00,4e,00,20,00,\
2f,00,6b,00,3a,00,4f,00,20,00,2f,00,6b,00,3a,00,50,00,20,00,2f,00,6b,00,3a,\
00,51,00,20,00,2f,00,6b,00,3a,00,52,00,20,00,2f,00,6b,00,3a,00,53,00,20,00,\
2f,00,6b,00,3a,00,54,00,20,00,2f,00,6b,00,3a,00,55,00,20,00,2f,00,6b,00,3a,\
00,56,00,20,00,2f,00,6b,00,3a,00,57,00,20,00,2f,00,6b,00,3a,00,59,00,20,00,\
2f,00,6b,00,3a,00,5a,00,20,00,2a,00,00,00,00,00

Session Manager.reg 부분.png

- Setup.reg 부분 추가.....

^^; 제가 이 부분을 찾지 못해서 헤매고 있던 부분인데 플라워님이 가르쳐 주셔서 부팅이 가능했습니다.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\{bf1a281b-ad7b-4476-ac95-f47682990ce7}G:/01/Windows/System32/config/SYSTEM\Setup]
"CmdLine"="Pecmd.exe Main %Windir%\\system32\\SwitchToAdmin.ini"

---------------------------

이렇게 레지를 추가하고 바로 테스트하시면 현재 주신 PE도 바로 어드민계정으로 부팅이 가능합니다.

이제 PE에 필요한 부분을 만져야하는데....

- 다른 고수님 어드민 PE를 참조해서

- autorun.cmd / pecmd.ini / SwitchToAdminLogon.ini 파일들을 어드민 계정에 맞춰 수정하면 됩니다.

그리고 추가된 부팅 시작항목 레지중에 "PinTool" 항목은 수정해 사용하세요.

위 처음 레지부터 살펴보면 Pin 을 설정하는 부분이 한군데 더 나와요...

정리해서 글을 써야하는데 제가 다른 공부중이라 잊어버릴 것 같아 급하게 작업합니다.

아참.... 이렇게 부팅이 가능한 조건은 빌드 시

Sofeware 레지DB를 체크한 상태가 전제 조건입니다.

이 부분을 체크하지않고 빌드하면 파일들이 부족하고, 또 어드민계정에 레지도 부족합니다.

부족한 레지 부분은 플라워님이 설명했습니다.

https://windowsforum.kr/lecture/10050614

그리고 부족한 파일은...
WINDOWS 폴더에....

├─INF
│ wvmic_ext.inf
│
├─security
│ ├─ApplicationId
│ │ └─PolicyManagement
│ │ AppIdPolicy.xsd
│ │
│ ├─audit
│ ├─cap
│ └─EDP
├─System32
│ │ activeds.dll
│ │ adsldpc.dll
│ │ apprepapi.dll
│ │ AuthExt.dll
│ │ autorun.cmd
│ │ BCP47mrm.dll
│ │ certca.dll
│ │ certcli.dll
│ │ CredDialogBroker.dll
│ │ CredProv2faHelper.dll
│ │ CredProvDataModel.dll
│ │ credprovhost.dll
│ │ credprovs.dll
│ │ credprovslegacy.dll
│ │ cscdll.dll
│ │ dfscli.dll
│ │ Faultrep.dll
│ │ FontGlyphAnimator.dll
│ │ gpsvc.dll
│ │ hnetcfg.dll
│ │ logoncli.dll
│ │ LogonController.dll
│ │ LogonUI.exe
│ │ msiltcfg.dll
│ │ mtxex.dll
│ │ nlaapi.dll
│ │ pecmd.ini
│ │ profext.dll
│ │ profprov.dll
│ │ profsvc.dll
│ │ profsvcext.dll
│ │ runas.exe
│ │ runonce.exe
│ │ SecEdit.exe
│ │ Sens.dll
│ │ SensApi.dll
│ │ SwitchToAdmin.ini
│ │ SwitchToAdminLogon.ini
│ │ threadpoolwinrt.dll
│ │ tscon.exe
│ │ tsdiscon.exe
│ │ userinit.exe
│ │ usermgr.dll
│ │ usermgrcli.dll
│ │ UserMgrProxy.dll
│ │ weretw.dll
│ │ WerFault.exe
│ │ wersvc.dll
│ │ whoami.exe
│ │ wincorlib.dll
│ │ Windows.Globalization.Fontgroups.dll
│ │ Windows.Internal.UI.Logon.ProxyStub.dll
│ │ Windows.System.RemoteDesktop.dll
│ │ Windows.UI.CredDialogController.dll
│ │ Windows.UI.Logon.dll
│ │ Windows.UI.Xaml.dll
│ │ Windows.UI.Xaml.Resources.rs4.dll
│ │ Windows.UI.XamlHost.dll
│ │ wmiclnt.dll
│ │
│ ├─en-US
│ │ gpsvc.dll.mui
│ │ runas.exe.mui
│ │ secedit.exe.mui
│ │ tscon.exe.mui
│ │ tsdiscon.exe.mui
│ │ whoami.exe.mui
│ │ windows.ui.xaml.dll.mui
│ │
│ └─ko-KR
│ activeds.dll.mui
│ AuthExt.dll.mui
│ certca.dll.mui
│ certcli.dll.mui
│ CredDialogBroker.dll.mui
│ CredProv2faHelper.dll.mui
│ credprovhost.dll.mui
│ credprovs.dll.mui
│ credprovslegacy.dll.mui
│ faultrep.dll.mui
│ gpsvc.dll.mui
│ hnetcfg.dll.mui
│ LogonController.dll.mui
│ profext.dll.mui
│ profsvc.dll.mui
│ runas.exe.mui
│ runonce.exe.mui
│ secedit.exe.mui
│ sens.dll.mui
│ tscon.exe.mui
│ tsdiscon.exe.mui
│ userinit.exe.mui
│ usermgr.dll.mui
│ WerFault.exe.mui
│ wersvc.dll.mui
│ whoami.exe.mui
│ Windows.UI.CredDialogController.dll.mui
│ windows.ui.xaml.dll.mui
│
├─SystemResources
│ ├─Windows.UI.Cred
│ │ │ Windows.UI.Cred.pri
│ │ │
│ │ └─pris
│ │ Windows.UI.Cred.ko-KR.pri
│ │
│ ├─Windows.UI.Logon
│ │ │ Windows.UI.Logon.pri
│ │ │
│ │ └─pris
│ │ Windows.UI.Logon.ko-KR.pri
│ │
│ └─Windows.UI.ShellCommon
│ │ Windows.UI.ShellCommon.pri
│ │
│ ├─ActionCenter
│ │ └─Assets
│ │ └─Fonts
│ ├─ClockFlyoutExperience
│ │ └─Assets
│ │ └─Fonts
│ │ CoreMDL2.1.69.ttf
│ │
│ ├─pris
│ │ Windows.UI.ShellCommon.ko-KR.pri
│ │
│ ├─SharePickerUI
│ │ └─Assets
│ │ └─Fonts
│ │ SharMDL2.ttf
│ │
│ └─StartUI
│ └─Assets
│ └─Fonts
│ BitMDL2.ttf
│ SkypeUISymbol-Regular.ttf
│
└─WinSxS
├─amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.17134.1_none_d3691f50bbf5e7a6
│ defltbase.inf
│ defltrdsh.inf
│ defltwk.inf
│ dwup.inf
│ puwk.inf
│
└─Manifests
amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.17134.1_none_d3691f50bbf5e7a6.manifest

이렇게 됩니다. ^^;