0

Is there any way to monitor/debug changes made by an installation to the OS registry? I'm aware of Process Monitor but I look for something that I can run in the background.

1 Answer 1

1

Many tools can do that. Regshot, InstallWatch Pro, InCtrl5 are some of them widely used. Get one that fits you well and use it.

From Windows itself, you could use WMIC to track changes using the RegistryKeyChangeEvent class. You would have to create a WqlEventQuery object and use the ManagementEventWatcher to watch over these events. When a change occurs, the EventArrived of the ManagementEventWatcher class is activated.

There are disadvantages to this:

"HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" are not supported.

WMI event does not return the changed value and changed type; it only detects the change itself.

2
  • Thank you. But does the OS itself offer something similar ?
    – cyzczy
    Commented Feb 1, 2017 at 9:15
  • I have updated the answer.
    – Overmind
    Commented Feb 1, 2017 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .