Record changes made by app installation [closed]

Question

Possible Duplicate:
Looking for an program installer monitor or recorder

I'd like to record the changes that occur to my system between two points in time, including during a reboot. I have an application which is affected adversely by a reboot. It's easy to fix, I just run the installer and it "fixes" itself. But I'd like to know what is being overwritten. Could be reg, could be file, not sure. Thus the question.

There used to be a tool from Novell called Zenworks which came with a tool to record system changes. You used it to set up deployable applications. Does something similar exist today that I can download from somewhere? I.e. It has to have a consumer or open source price tag/

Thanks

Answer 1

there are various ways to solve this.

procmon is good for monitoring what a process does, but it doesnt give you a summary of the changes to a system.

there are plenty of tools for that but the only free one i know is sysdiff from microsoft. its pretty old and will contain a lot of noise in the result, but it should do the job. you can run step one (analyse system), reboot, run step two (analyse and compare).

if you only want to compare registry changes "regshot" will do.

another attempt to troubleshoot your problem is to check whats run at windows startup (and breaks the application). you can use sysinternals autoruns for that, or usual places(like startup folder and "run" regkey) by hand

if your setup is a msi file you could let it write a logfile while repairing and check what file/regkey was missing (with msiexec.exe /i mysetup.msi /l*v c:\mylog.log)

another way would be (also only works with MSIs) is to repair it selectively and check if it works again. e.g. msiexec /fu mysetup.msi (only repair HKCU keys, if it works now the problem is a regkey) msiexec /fo mysetup.msi (repair missing files) etc etc

tell me if you need more information about a specific method, i'm just giving you an overview here. more details about every method would be a bit much to write now :)

Answer 2

You can use ProcMon from SysInternals, to capture all the registry, file system and DLL operations. Using filters, you can zero in on what affects your application.

In the past, I used a much better targeted application called AppSight (now belongs to BMC software) to solve such issues, but it's a very expensive piece of software (> $100k).

ProcMon should do it for you.