Is there a way to track changes in Windows registry? I'd like to see what changes in the registry are made during installation of various programs.
Add a comment
|
10 Answers
Process Monitor allows you to monitor file and registry activity of various processes.
1 Comment
Bohdan Kuts
But how to do that? Using some instruction like this one: howtogeek.com/school/sysinternals-pro/lesson5/all ?
Can monitor registry changes made by specific program.
https://www.nirsoft.net/utils/reg_file_from_application.html
UPDATE: Just download NirLauncher (which includes all applications from NirSoft). It is one of the best additions to your Windows toolbox. https://launcher.nirsoft.net/
1 Comment
and1er
For me
RegistryChangesView (nirsoft.net/utils/registry_changes_view.html) from NirLauncher package was more useful: it creates two snapshots (e.g. before and after the installation) and then compares them. The result could be exported to a .txt-file. In my use case it found 301 registry change after the app installation. In the same time RegFromApp (attached to msiexec.exe process) found just 1 change.Regarding WMI and Registry:
There are three WMI event classes concerning registry:
RegistryTreeChangeEventRegistryKeyChangeEventRegistryValueChangeEvent
But you need to be aware of these limitations:
With
RegistryTreeChangeEventandRegistryKeyChangeEventthere is no way of directly telling which values or keys actually changed. To do this, you would need to save the registry state before the event and compare it to the state after the event.You can't use these classes with
HKEY_CLASSES_ROOTorHKEY_CURRENT_USERhives. You can overcome this by creating a WMI class to represent the registry key to monitor:
Defining a Registry Class with Qualifiers
and use it with __InstanceOperationEvent derived classes.
So, using WMI to monitor the Registry is possible, but less than perfect. The advantage is that it is possible to monitor the changes in 'real time'. Another advantage could be WMI permanent event subscription:
a method to monitor the Registry 'at all times', i.e. event if your application is not running.
Comments
A straightforward way to do this with no extra tools is to export the registry to a text file before the install, then export it to another file after. Then, compare the two files.
Having said that, the Sysinternals tools are great for this.
Comments
Regshot deserves a mention here. It scans and takes a snapshot of all registry settings, then you run it again at a later time to compare with the original snapshot, and it shows you all the keys and values that have changed.
1 Comment
gargoylebident
May be worth noting there is an improved version but the site is gone with no official way to obtain the installer.
There is a python-hids called sobek ( http://code.google.com/p/sobek-hids/ ) that is able to monitor some parts of the SO. It's working fine for my for monitoring file changes, and although the doc sais that it's able to monitor registry changes it does not work for me.
Good piece of software for easily deplay a python based hids.
Comments
There are a few different ways. If you want to do it yourself on the fly WMI is probably the way to go. RegistryKeyChangeEvent and its relatives are the ones to look at. There might be a way to monitor it through __InstanceCreationEvent, __InstanceDeletionEvent and __InstanceModificationEvent classes too.
http://msdn.microsoft.com/en-us/library/aa393040(VS.85).aspx
Comments
When using a VM, I use these steps to inspect changes to the registry:
- Using 7-Zip, open the vdi/vhd/vmdk file and extract the folder C:\Windows\System32\config
- Run OfflineRegistryView to convert the registry to plaintext
- Set the 'Config Folder' to the folder you extracted
- Set the 'Base Key' to
HKLM\SYSTEMorHKLM\SOFTWARE - Set the 'Subkey Depth' to 'Unlimited'
- Press the 'Go' button
Now use your favourite diff program to compare the 'before' and 'after' snapshots.
Comments
I concur with Franci, all Sysinternals utilities are worth taking a look (Autoruns is a must too), and Process Monitor, which replaces the good old Filemon and Regmon is precious.
Beside the usage you want, it is very useful to see why a process fails (like trying to access a file or a registry key that doesn't exist), etc.
Comments
PhiLho has mentioned AutoRuns in passing, but I think it deserves elaboration.
It doesn't scan the whole registry, just the parts containing references to things which get loaded automatically (EXEs, DLLs, drivers etc.) which is probably what you are interested in. It doesn't track changes but can export to a text file, so you can run it before and after installation and do a diff.
