greghmerrill's questions

Links such as the following suggest that I should be able to edit the registry without elevated privileges, as long as I only update HKEY_CURRENT_USER.

https://blog.codeinside.eu/2015/08/11/reg-exe-or-how-to-import-reg-files-without-admin-privileges/

However, my observation is that a command like this gets an error:

reg add "HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome\AutoSelectCertificateForUrls" /v 1 /d {"pattern":"https://[*.]somedomain.com","filter":{"SUBJECT":{"CN":"MyCNValue"}}}

Is this expected, i.e. only administrators are permitted to update registry entries for anything, including HKEY_CURRENT_USER? Or have I overlooked something?

For what it's worth ... read queries of HKEY_CURRENT_USER are working fine without admin privileges:

Occasionally (maybe once a day), when I download any file with my browser and first try to open the download, my Windows 8 box CPU spikes to 100% for a minute or more. The file doesn't open until this spike subsides. (Not to mention that I can't do anything else which accesses the disk until it finishes.)

In looking at the Performance Monitor, I see that the process consuming disk is MsMpEng.exe, which as I understand it is Windows Defender.

I see that it is accessing a whole bunch of "Package" files in a Windows\System32\catroot directory.

Does anyone know what it's doing here, and whether I can prevent and/or optimize it so I don't get these lengthy disk-blocking operations? My naive guess is that it's loading its dictionary of malware detection/correction definitions from disk into memory but I'm not sure.