0

Out of curiosity and as a backup attempt, I've exported whole PC registry into several text files, all arranged in git repository (to be able to easily track registry changes).

To be more specific, I've automated it with a simple PowerShell script:

reg export HKEY_CLASSES_ROOT ./HKEY_CLASSES_ROOT.reg /y
Get-Content ./HKEY_CLASSES_ROOT.reg | Set-Content -Encoding utf8 ./HKEY_CLASSES_ROOT.txt #convert to git friendly encoding
git add *.txt
git commit -m "$($date.ToString("yyyy-MM-dd"))"

So far so good, but I've noticed one strange thing when I started comparing git diff between commits.

Even when I don't change anything in the system between commits it appears I still get over 100 diff changes in registry, in short timespans (few minutes), but the amount of these changes is mostly the same every time:

  • HKEY_CLASSES_ROOT\Local Settings => always 32 changed registry keys

  • HKEY_CURRENT_USER\SOFTWARE => 26 changes

  • HKEY_LOCAL_MACHINE\SOFTWARE => 27 changes

  • HKEY_LOCAL_MACHINE\SYSTEM => 25 changes

  • HKEY_USERS => 10 changes

Example of changed keys:

  • HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftOfficeHub_8wexyz\HAM\AUI\Microsoft.MicrosoftOfficeHub\V1\LU

  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\AsimovUploader

  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits

  • HKEY_USERS\S-1-5-21-xyz-1001\SOFTWARE\Microsoft\OneDrive\Accounts

Example of changed values as shown by git diff:

 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits]
-"SecureTimeEstimated"=hex(b):6d,a3,54,d2,b8,3b,d8,01
-"SecureTimeHigh"=hex(b):6d,0b,19,34,c1,3b,d8,01
-"SecureTimeLow"=hex(b):6d,3b,90,70,b0,3b,d8,01
+"SecureTimeEstimated"=hex(b):8a,2e,04,38,ba,3b,d8,01
+"SecureTimeHigh"=hex(b):8a,96,c8,99,c2,3b,d8,01
+"SecureTimeLow"=hex(b):8a,c6,3f,d6,b1,3b,d8,01

I understand that some of these keys hold dates such as LastUpdate, but why so many keys (100+) are different every time I export the registry, even in short time intervals? It feels like some of these changes are just random values rather than timers.

Is this normal? I'm running Win 10 Professional.

4
  • From as far back as I can remember, the Windows Registry changes by the second (Windows open / close /alter position; data is entered kicking off autosave; and so on). Registry backups are always behind the current registry data. This is to say: constantly changing registry is not at all new.
    – John
    Mar 19 at 19:10
  • 1
    “Is this normal?” - Yes
    – Ramhound
    Mar 19 at 20:14
  • 1
    There are tools like Sysinternals ProcessMonitor that show Registry reads and writes in real time. You would be surprised how many of them occur every second. Such tools can also display which processes caus those requests.
    – Robert
    Mar 19 at 21:09
  • Even a few minutes of monitoring the registry will generate any where from 100,000 to over 1 million accesses. The vast majority will be READ, but some will be write. I would have to agree that your experience is NORMAL.
    – cybernard
    Mar 21 at 19:53

1 Answer 1

0

Windows reports continuously on what it is doing, and the registry is one of its most-used mechanisms.

For example, the registry is one of the main sources of the information that is shown by the Resource Monitor. You may find technical details in the article About Performance Counters. There are very many such counters, many of them change many times per second.

However, performance is not the only information that is changing all the time - some drivers also update continuously their status and data in the registry.

But rest assured that it is quite normal for so many changes to go on all the time, and this is not taken to be a performance problem.

4
  • Windows reporting what it is doing, especially performance counters, is not related to registry changes.
    – Daniel B
    Mar 19 at 21:34
  • "Performance data is not actually stored in the registry.", so yeah. OPs examples are also in other locations.
    – Daniel B
    Mar 19 at 22:50
  • @DanielB: Performance data is only an example, perhaps the most active one, and its implementation is a great puzzle to me (why use registry functions and where is this registry hive stored?). The OP's keys show the Time service, Office and others. Many many programs keep temporary and permanent data in the registry. This isn't very healthy, but is done because it's too easy when having a ready-made database inside the OS.
    – harrymc
    Mar 20 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.