golang.zx2c4.com/wireguard/windows@v0.5.4-0.20230123132234-dcc0eb72a04b/docs/adminregistry.md (about)

     1  # Registry Keys for Admins
     2  
     3  These are advanced configuration knobs that admins can set to do unusual things
     4  that are not recommended. There is no UI to enable these, and no such thing is
     5  planned. These registry keys may also be removed at some point in the future.
     6  The uninstaller will clean up the entirety of `HKLM\Software\WireGuard`. Use
     7  at your own risk, and please make sure you know what you're doing.
     8  
     9  #### `HKLM\Software\WireGuard\LimitedOperatorUI`
    10  
    11  When this key is set to `DWORD(1)`, the UI will be launched on desktops of
    12  users belonging to the Network Configuration Operators builtin group
    13  (S-1-5-32-556), with the following limitations for members of that group:
    14  
    15    - Configurations are stripped of all public, private, and pre-shared keys;
    16    - No version update popup notifications are shown, and updates are not permitted, though a tab still indicates the availability;
    17    - Adding, removing, editing, importing, or exporting configurations is forbidden; and
    18    - Quitting the manager is forbidden.
    19  
    20  However, basic functionality such as starting and stopping tunnels remains intact.
    21  
    22  ```
    23  > reg add HKLM\Software\WireGuard /v LimitedOperatorUI /t REG_DWORD /d 1 /f
    24  ```
    25  
    26  #### `HKLM\Software\WireGuard\DangerousScriptExecution`
    27  
    28  When this key is set to `DWORD(1)`, the tunnel service will execute the commands
    29  specified in the `PreUp`, `PostUp`, `PreDown`, and `PostDown` options of a
    30  tunnel configuration. Note that this execution is done as the Local System user,
    31  which runs with the highest permissions on the operating system, and is therefore
    32  a real target of malware. Therefore, you should enable this option only with the
    33  utmost trepidation. Rather than use `%i`, WireGuard for Windows instead sets the
    34  environment variable `WIREGUARD_TUNNEL_NAME` to the name of the tunnel when
    35  executing these scripts.
    36  
    37  ```
    38  > reg add HKLM\Software\WireGuard /v DangerousScriptExecution /t REG_DWORD /d 1 /f
    39  ```