I am looking for a program for Microsoft Windows that can log which program changed a registry key.
Any license and price is fine.
asked Sep 2, 2018 at 21:02
-
1Is Process Monitor not enough?– HeadcrabSep 3, 2018 at 1:52
-
Any registry monitoring softwares itechtics.com/monitor-system-file-registry-changes– LearnerSep 3, 2018 at 3:59
-
@Headcrab: Does Process Monitor tell you what program modified what registry key? I don't think so, but if I am wrong please post an answer, thanks!– Nicolas Raoul ♦Sep 3, 2018 at 8:48
-
2@SIslam: None of these tools seem to show what program modified what registry key. If one of them does, please post an answer and include a screenshot showing that, thanks!– Nicolas Raoul ♦Sep 3, 2018 at 8:49
-
@Nicolas Raoul Long ago there was a standalone utility called "regmon", which I used for that very purpose. Later they integrated that into "procmon", along with "filemon" and whatnot. But it's been ages since I used either of them, so I don't quite remember, that's why only a comment.– HeadcrabSep 3, 2018 at 11:57
|
Show 2 more comments
1 Answer
So, about Process Monitor, a. k. a. procmon. When you launch the program, you see this:
As you can see (in the "Operation" column), it logs file and registry access (don't remember what else, but, anyway, only files and registry are shown here). Let's say we only want to log registry key changes. Then we have to add filters, for example:
Those red crosses are the default filters (to exclude the procmon itself from the log, etc.), and the top most green one is the one I just added. Now our log window looks like this:
You can add more filters - for example, for the "Path" to start with "HKCU\Software\Microsoft\blahblah" to monitor that particular registry branch, or to be exactly "HKCU\Software\Microsoft\blahblah\mywonderfulkey" to monitor only that key, etc.
You can also run procmon in "Quiet mode" from the command line, although I am not sure if you can set filters if you do that.
