0

is there any way to monitor, debug changes made by a installation to the OS registry ? I'm aware of Process Monitor but I look for something that I can enable and that will run in the background.

thank you

1

Many tools can do that. Regshot, InstallWatch Pro, InCtrl5 are some of them widely used. Get one that fits you well and use it.

From Windows itself, you could use WMIC to track changes using the RegistryKeyChangeEvent class. You would have to create a WqlEventQuery object and use the ManagementEventWatcher to watch over these events. When a change occurs, the EventArrived of the ManagementEventWatcher class is activated.

There are disadvantages to this:

"HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" are not supported.

WMI event does not return the changed value and changed type; it only detects the change itself.

  • Thank you. But does the OS itself offer something similar ? – cyzczy Feb 1 '17 at 9:15
  • I have updated the answer. – Overmind Feb 1 '17 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.