Edit

AppInit_DLLs in Windows 7 and Windows Server 2008 R2

  • Article

Platform

Clients - Windows 7
Servers - Windows Server 2008 R2

Feature Impact

Severity - Low
Frequency - Low

Description

AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system. Microsoft is modifying the AppInit DLLs facility in Windows 7 and Windows Server 2008 R2 to add a new code-signing requirement. This will help improve the system reliability and performance, as well as improve visibility into the origin of software.

Configuration

Values stored under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \Windows key in the registry determine the behavior of the AppInit_DLLs infrastructure. The table below describes these registry values:

Value Description Sample Values
LoadAppInit_DLLs (REG_DWORD)${REMOVE}$
 Globally enables or disables AppInit_DLLs.${REMOVE}$
 0x0 – AppInit_DLLs are disabled.
0x1 – AppInit_DLLs are enabled.
AppInit_DLLs (REG_SZ) Space or comma delimited list of DLLs to load. The complete path to the DLL should be specified using Short Names. C:\ PROGRA~1\WID288~1\MICROS~1.DLL
RequireSignedAppInit_DLLs (REG_DWORD)${REMOVE}$
 Only load code-signed DLLs.${REMOVE}$
 0x0 – Load any DLLs.
0x1 – Load only code-signed DLLs.

 

Windows 7

All DLLs that are loaded by the AppInit_DLLs infrastructure should be code-signed. In the interests of application compatibility, the Windows 7 Operating System will load all AppInit DLLs. However, Microsoft recommends that all application developers code-sign their DLLs to help improve the reliability of Windows and prepare for code-signing enforcement in future versions of Windows. The RequireSignedAppInit_DLLs registry key controls this behavior and its value on Windows 7 is set to 0 by default.

Windows Server 2008 R2

All DLLs that are loaded by the AppInit_DLLs infrastructure must be code-signed. The RequireSignedAppInit_DLLs registry key controls this behavior and its value on Windows Server 2008 R2 is set to 1 by default.

AppInit DLLs in Windows 7 and Windows Server 2008 R2