Something somewhere is modifying a value in a registry key, and I want to track it down.

I thought I might set up ProcMon to watch that value, but as far as I can tell, it only filters to keys. There is far too much noise for me at that level.


All you need to do is filter on the RegSetValue operation as well as filtering the Path to match the registry key you want to monitor.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.