4

Does anyone have a good tool for silent, real-time, system-wide registry monitoring?

All of the tools I've seen have one of two problems:

  1. They poll for changes, instead of get events in real-time
  2. They can't be run without an intrusive GUI (procmon!!)

This seems like it would be a simple and straightforward utility and yet I haven't been able to find one yet, which surprises me.

Thanks!

Note: This is for Windows 7 x64.

Improve this question
2

Process Monitor has a GUI as you mentioned.

And it also has a feature called "Boot Logging", which turns Process Monitor into a driver that monitors everything silently until you start it again and disable it.

Process Monitor Boot Logging

Improve this answer
1

There is a solution to the GUI problem. You run the application as service in Session 0.

There is an program that allows you to access Session 0 GUIs so you can interact with them as needed.

http://www.coretechnologies.com/products/SwitchToSession0/

Improve this answer
  • interesting! wasn't aware of that capability. Is there anything special that needs to be done to run it as a service? I tried a few different ways to install exe as a service (nssm, sc, srvany, etc) without any luck, but I might have been doing it wrong... – J B May 3 '15 at 2:39
  • Sorry, I've never had a need to use it or install my own service. I stumbled upon it (or a similar piece of software) years ago and thought it was interesting. I wish I had an answer for you. – BlindWanderer May 11 '15 at 1:07
  • 1
    @BlindWanderer, What is this program all about? It says "Unable to start Switch To Session 0: This application will not run on this version of Windows because Session 0 is not available here." – Pacerier Jun 9 '15 at 9:53

Your Answer

By clicking β€œPost Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.