I need to monitor a specific registry key in HKCU for changes. Most importantly I need to know when it changed, who changed it (the process) and what it changed too.

I know this can be done via Proc Mon, however the complications of the situation means I can't go installing new external software onto a machine I need to monitor. Also the command line use of this program isn't suitable for my needs.

I can however implement a VBS or small c# / VB application, so long as it runs silently.

Is there a simple way to monitoring a key and if it changes record the change? Again, most important thing here is which process changed it.

Any thoughts on how this can be done appreciated.

  • If you can't install software why can you run a VB script?
    – Ramhound
    Aug 20 '12 at 15:18
  • It's a customers network and customers build of machines. It'll be easier to persuade them to run something lightweight.
    – Damo
    Aug 20 '12 at 15:24
  • 1
    Why is the Process Monitor command-line insufficient? And what's wrong with Process Monitor (which is portable, live.sysinternals.com/procmon.exe) that makes it worse than your own script or executable? Aug 20 '12 at 16:03
  • @TomWijsman because the environment it must work in will not allow pop-ups or questions to the user. This cannot happen. Even with /quiet /minimized etc... set, ProcMon still asks questions on load following a reboot.
    – Damo
    Aug 22 '12 at 15:42

You can use MS Windows built in auditing to monitor changes via the Security event logs.

Enable "Audit Object Access" via either the group or local security policy. Security Settings/Local Policy/Audit Policy/Audit object access (Success, Failure).

Open the Registry and adjust the Permissions on HKCU (or the specific subkey). Permissions/Advanced/Auditing. Add the Everyone user and select the Access types you want to monitor.

All registry add, remove, edit, etc will be logged in the Security event log. Filter as needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.