Disable the Remote Registry Service to Prevent Remote Registry Enumeration and Modification

An attacker with any valid domain credentials can connect to the Remote Registry service and enumerate registry keys to discover security configurations, software inventory, and potential privilege escalation paths. Certain lateral movement techniques write persistence mechanisms directly to the registry remotely.

The Remote Registry service (RemoteRegistry) allows authenticated remote connections to read and write the Windows registry over the network. Attackers use it during reconnaissance to enumerate installed software, security configurations, and service accounts. Lateral movement tools use Remote Registry to deploy malware by writing service entries or scheduled task configurations.

Probably yes if any of these apply:

Remote Registry is used by many legitimate management tools (SCCM, some monitoring agents) but also by attacker toolkits. If your environment doesn't have software that requires it, disabling it removes the service with no operational impact.