On the server, check Remote Registry service.

You can check permissions via the registry - winreg key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers

The defaults I've seen have been Administrators Group and Backup Operators Group having access to the registry over the network. I believe there are also GPOs that can affect this.

Sue