4

Does anyone have a good tool for silent, real-time, system-wide registry monitoring?

All of the tools I've seen have one of two problems:

  1. They poll for changes, instead of get events in real-time
  2. They can't be run without an intrusive GUI (procmon!!)

This seems like it would be a simple and straightforward utility and yet I haven't been able to find one yet, which surprises me.

Thanks!

Note: This is for Windows 7 x64.

Improve this question
1

2 Answers 2

Reset to default
2

Process Monitor has a GUI as you mentioned.

And it also has a feature called "Boot Logging", which turns Process Monitor into a driver that monitors everything silently until you start it again and disable it.

Process Monitor Boot Logging

Improve this answer
1

There is a solution to the GUI problem. You run the application as service in Session 0.

There is an program that allows you to access Session 0 GUIs so you can interact with them as needed.

http://www.coretechnologies.com/products/SwitchToSession0/

Improve this answer
3
  • interesting! wasn't aware of that capability. Is there anything special that needs to be done to run it as a service? I tried a few different ways to install exe as a service (nssm, sc, srvany, etc) without any luck, but I might have been doing it wrong...
    – J B
    Commented May 3, 2015 at 2:39
  • Sorry, I've never had a need to use it or install my own service. I stumbled upon it (or a similar piece of software) years ago and thought it was interesting. I wish I had an answer for you.
    – BlindWanderer
    Commented May 11, 2015 at 1:07
  • 1
    @BlindWanderer, What is this program all about? It says "Unable to start Switch To Session 0: This application will not run on this version of Windows because Session 0 is not available here."
    – Pacerier
    Commented Jun 9, 2015 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.