In this blog post, we’ll explore how to detect the source of registry key modifications on a Windows device. In other words, we’ll look into identifying who is adding, deleting, or changing registry keys, whether through Group Policy (GPO), Intune, SCCM, scripting, or other methods. Scenario: BitLocker Recovery Mode While investigating an event related to … Continue reading How to detect the source of registry key modifications on windows devices – Intune