Tracking changes in Windows registry

Question

Is there a way to track changes in Windows registry? I'd like to see what changes in the registry are made during installation of various programs.

Answer 1

Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) allows you to monitor file and registry activity of various processes.

Answer 2

I concur with Franci, all Sysinternals utilities are worth taking a look (Autoruns is a must too), and Process Monitor, which replaces the good old Filemon and Regmon is precious.

Beside the usage you want, it is very useful to see why a process fails (like trying to access a file or a registry key that doesn't exist), etc.

Answer 3

A straightforward way to do this with no extra tools is to export the registry to a text file before the install, then export it to another file after. Then, compare the two files.

Having said that, the Sysinternals tools are great for this.

Answer 4

There are a few different ways. If you want to do it yourself on the fly WMI is probably the way to go. RegistryKeyChangeEvent and its relatives are the ones to look at. There might be a way to monitor it through __InstanceCreationEvent, __InstanceDeletionEvent and __InstanceModificationEvent classes too.

---

http://msdn.microsoft.com/en-us/library/aa393040(VS.85).aspx

Answer 5

Regarding WMI and Registry:

There are three WMI event classes concerning registry:

• RegistryTreeChangeEvent
• RegistryKeyChangeEvent
• RegistryValueChangeEvent

(http://msdn.microsoft.com/en-us/library/aa393043(VS.85).aspx)

But you need to be aware of these limitations:

• With RegistryTreeChangeEvent and RegistryKeyChangeEvent there is no way of directly telling which values or keys actually changed. To do this, you would need to save the registry state before the event and compare it to the state after the event.

• You can't use these classes with HKEY_CLASSES_ROOT or HKEY_CURRENT_USER hives. You can overcome this by creating a WMI class to represent the registry key to monitor:

http://msdn.microsoft.com/en-us/library/aa389818(VS.85).aspx

and use it with __InstanceOperationEvent derived classes.

So using WMI to monitor the Registry is possible, but less then perfect. The advantage is that it is possible to monitor the changes in 'real time'. Another advantage could be WMI permanent event subscription:

http://msdn.microsoft.com/en-us/library/aa393014(VS.85).aspx

a method to monitor the Registry 'at all times', ie. event if your application is not running.

Answer 6

PhiLho has mentioned AutoRuns in passing, but I think it deserves elaboration.

It doesn't scan the whole registry, just the parts containing references to things which get loaded automatically (EXEs, DLLs, drivers etc.) which is probably what you are interested in. It doesn't track changes but can export to a text file, so you can run it before and after installation and do a diff.