event if your application is not running. Another advantage could be WMI permanent event subscription:Ī method to monitor the Registry 'at all times', ie. The advantage is that it is possible to monitor the changes in 'real time'. So using WMI to monitor the Registry is possible, but less then perfect. You can overcome this by creating a WMI class to represent the registry key to monitor:ĭefining a Registry Class With QualifiersĪnd use it with _InstanceOperationEvent derived classes. You can't use these classes with HKEY_CLASSES_ROOT or HKEY_CURRENT_USER hives. To do this, you would need to save the registry state before the event and compare it to the state after the event. With RegistryTreeChangeEvent and RegistryKe圜hangeEvent there is no way of directly telling which values or keys actually changed. There are three WMI event classes concerning registry:īut you need to be aware of these limitations: Registr圜hangesView is a tool for Windows that allows you to take a snapshot of Windows Registry and later compare it with another Registry snapshots, with the current Registry or with Registry files stored in a shadow copy created by Windows.

Process monitor registry changes