3

I am looking for a program for Microsoft Windows that can log which program changed a registry key.

Any license and price is fine.

  • 1
    Is Process Monitor not enough? – Headcrab Sep 3 '18 at 1:52
  • Any registry monitoring softwares itechtics.com/monitor-system-file-registry-changes – SIslam Sep 3 '18 at 3:59
  • @Headcrab: Does Process Monitor tell you what program modified what registry key? I don't think so, but if I am wrong please post an answer, thanks! – Nicolas Raoul Sep 3 '18 at 8:48
  • 2
    @SIslam: None of these tools seem to show what program modified what registry key. If one of them does, please post an answer and include a screenshot showing that, thanks! – Nicolas Raoul Sep 3 '18 at 8:49
  • @Nicolas Raoul Long ago there was a standalone utility called "regmon", which I used for that very purpose. Later they integrated that into "procmon", along with "filemon" and whatnot. But it's been ages since I used either of them, so I don't quite remember, that's why only a comment. – Headcrab Sep 3 '18 at 11:57
1

So, about Process Monitor, a. k. a. procmon. When you launch the program, you see this:

enter image description here

As you can see (in the "Operation" column), it logs file and registry access (don't remember what else, but, anyway, only files and registry are shown here). Let's say we only want to log registry key changes. Then we have to add filters, for example:

enter image description here

Those red crosses are the default filters (to exclude the procmon itself from the log, etc.), and the top most green one is the one I just added. Now our log window looks like this:

enter image description here

You can add more filters - for example, for the "Path" to start with "HKCU\Software\Microsoft\blahblah" to monitor that particular registry branch, or to be exactly "HKCU\Software\Microsoft\blahblah\mywonderfulkey" to monitor only that key, etc.

You can also run procmon in "Quiet mode" from the command line, although I am not sure if you can set filters if you do that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.