Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to monitor a specific registry key in HKCU for changes. Most importantly I need to know when it changed, who changed it (the process) and what it changed too.

I know this can be done via Proc Mon, however the complications of the situation means I can't go installing new external software onto a machine I need to monitor. Also the command line use of this program isn't suitable for my needs.

I can however implement a VBS or small c# / VB application, so long as it runs silently.

Is there a simple way to monitoring a key and if it changes record the change? Again, most important thing here is which process changed it.

Any thoughts on how this can be done appreciated.

share|improve this question
    
If you can't install software why can you run a VB script? –  Ramhound Aug 20 '12 at 15:18
    
It's a customers network and customers build of machines. It'll be easier to persuade them to run something lightweight. –  Damo Aug 20 '12 at 15:24
1  
Why is the Process Monitor command-line insufficient? And what's wrong with Process Monitor (which is portable, live.sysinternals.com/procmon.exe) that makes it worse than your own script or executable? –  Tom Wijsman Aug 20 '12 at 16:03
    
@TomWijsman because the environment it must work in will not allow pop-ups or questions to the user. This cannot happen. Even with /quiet /minimized etc... set, ProcMon still asks questions on load following a reboot. –  Damo Aug 22 '12 at 15:42
add comment

1 Answer

You can use MS Windows built in auditing to monitor changes via the Security event logs.

Enable "Audit Object Access" via either the group or local security policy. Security Settings/Local Policy/Audit Policy/Audit object access (Success, Failure).

Open the Registry and adjust the Permissions on HKCU (or the specific subkey). Permissions/Advanced/Auditing. Add the Everyone user and select the Access types you want to monitor.

All registry add, remove, edit, etc will be logged in the Security event log. Filter as needed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.