8

It seems many people like using Process Monitor to see what changes are being made to the registry during a process. So I downloaded it.

I want to see what changes are made in the registry by some config changes I'm making on my computer so I can write them into a vbs script to do them easily. Can someone tell me how to drive Process Monitor to capture the info? In the Help I don't see how to do it.

I'm using Windows 7 home Premium 64 bit.

Improve this question
5
  • What OS? Also, it does not run in a browser.
    – KCotreau
    Aug 2, 2011 at 1:06
  • If it matters I should've been more clear and said that the right pane of the Help is where the message comes up. The left side pane is the navigation with the Contents, Index, and Search tabs.
    – CChriss
    Aug 2, 2011 at 2:30
  • Yup that makes all the difference. My answer does not apply anymore. [delete]
    – James T
    Aug 2, 2011 at 2:42
  • I added a new answer for ya. I misunderstood the question at first. Hopefully it's helpful now.
    – James T
    Aug 2, 2011 at 2:48
  • Did you run it from within the downloaded ZIP file, or did you extract all the files to a directory, and then run it?
    – KCotreau
    Aug 2, 2011 at 2:49

2 Answers 2

Reset to default
8

In the directory where procmon.exe resides, there should also be a file called procmon.chm (if you extracted them to the same place). Right click on procmon.chm and properties. Then click "Unblock".

You are experiencing the issue described here.

Edit:

Now to address the actual question.

  1. Open up process monitor.

  2. The filters will probably show up. Press reset to reset the filters and click OK. Otherwise you can open them with ctrl-L and press reset.

  3. There is an icon on the top toolbar that looks like cross hairs with circles (8th from the left). Drag that to the (config) window who's activity you want to watch (if you want to filter on that process). You might otherwise clutter up your readings with activities from other processes.

  4. Clear the activity log (ctrl-x).

  5. Now make your config changes and watch the registry keys fly by.

Improve this answer
3
  • @CChriss Oh Right... forgot there was more to the question. I updated my answer again.
    – James T
    Aug 2, 2011 at 3:10
  • Works great. Thank you again for all your help.
    – CChriss
    Aug 5, 2011 at 4:02
  • @JamesT, I get too many captured registry-related info when using this method with gpedit.msc. As this will probably be a different problem, I have opened another thread: superuser.com/questions/946123/…
    – Sopalajo de Arrierez
    Jul 28, 2015 at 0:22
2

CHM files (compiled html) are "blocked" by default as a security measure in Windows 7. Find the help file that belongs to Process Monitor, view it's properties, and click the unblock button.

As for Process Monitor itself, it collects a lot of data, so you'll want to try and filter what you're looking for. You can do this a couple of ways. You can just capture all of the data to a capture file, then open it to filter the data viewed - this still preserves all of your data. You can also configure your filters to capture only the data you want to see, and save that - less resource hungry, but you lose data that you may want to see later.

If you only downloaded Process Monitor, I suggest taking a look at the rest of tools available in the Sysinternals Suite. They're great for troubleshooting and better understanding how Windows works.

Improve this answer
1
  • +1. Now that I actually can look into the Help I didn't see any instructions on how to do what I need Proc Mon for.
    – CChriss
    Aug 2, 2011 at 3:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .