I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from
HKLM\…, that corresponds to the registry hives
HKEY_LOCAL_MACHINE that can be seen using Regedit. But some entries have the Path starting from
Could you please explain what part of the registry it is? Can I see it using Regedit or some other utility? Can I access it programmatically?
I am running Windows 8.1 Enterprise x64.
UPDATE: I've contacted Procmon developers and they pointed me to the following MSDN resources covering this question: