3

I am looking for a program for Microsoft Windows that can log which program changed a registry key.

Any license and price is fine.

7
  • 1
    Is Process Monitor not enough?
    – Headcrab
    Sep 3, 2018 at 1:52
  • Any registry monitoring softwares itechtics.com/monitor-system-file-registry-changes
    – Learner
    Sep 3, 2018 at 3:59
  • @Headcrab: Does Process Monitor tell you what program modified what registry key? I don't think so, but if I am wrong please post an answer, thanks!
    – Nicolas Raoul
    Sep 3, 2018 at 8:48
  • 2
    @SIslam: None of these tools seem to show what program modified what registry key. If one of them does, please post an answer and include a screenshot showing that, thanks!
    – Nicolas Raoul
    Sep 3, 2018 at 8:49
  • @Nicolas Raoul Long ago there was a standalone utility called "regmon", which I used for that very purpose. Later they integrated that into "procmon", along with "filemon" and whatnot. But it's been ages since I used either of them, so I don't quite remember, that's why only a comment.
    – Headcrab
    Sep 3, 2018 at 11:57

1 Answer 1

1

So, about Process Monitor, a. k. a. procmon. When you launch the program, you see this:

enter image description here

As you can see (in the "Operation" column), it logs file and registry access (don't remember what else, but, anyway, only files and registry are shown here). Let's say we only want to log registry key changes. Then we have to add filters, for example:

enter image description here

Those red crosses are the default filters (to exclude the procmon itself from the log, etc.), and the top most green one is the one I just added. Now our log window looks like this:

enter image description here

You can add more filters - for example, for the "Path" to start with "HKCU\Software\Microsoft\blahblah" to monitor that particular registry branch, or to be exactly "HKCU\Software\Microsoft\blahblah\mywonderfulkey" to monitor only that key, etc.

You can also run procmon in "Quiet mode" from the command line, although I am not sure if you can set filters if you do that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.