Changed value in Registry

Question

Is there an application to track the changed reg key value, once we change setting in application?

score 5 · Answer 1 · answered Aug 23 '10 at 18:50

5

Process Monitor will let you track Registry activity in realtime.

answered Aug 23 '10 at 18:50

Massimo

70,200
57
200
323

give a lot of information which is not helpful to find the changed value, i am changing one of symantec setting and i need to know what is changing in registery, in order to make a reg key and import it to other clients – Eddy Sep 03 '10 at 01:42

score 2 · Answer 2 · answered Aug 23 '10 at 18:52

2

I use regshot (freeware) it allows to create snapshots before and after the change (for example an installation) Afterwards you can compare the snapshots and find all changes.

answered Aug 23 '10 at 18:52

WilfriedVS

876
6
3

You could also just export the registry and compare with `diff`. – Zoredache Aug 23 '10 at 18:53
didn't work for me – Eddy Sep 03 '10 at 01:40

score 1 · Answer 3 · answered Jan 28 '11 at 21:07

Process Monitor also allows a myriad of filters to be set - so you could, for example, filter by process and only see the effects from the Symantec process you mentioned.

And if you're not sure which process to monitor, Process Explorer (another SysInternals tool) lets you drag a bullseye over an application to identify the process in the Process Explorer window.

score 0 · Answer 4 · answered Jan 28 '11 at 22:15

Microsoft's Attack Surface Analyzer is a free (beta at the moment) tool that takes snapshots and compares not only registry keys but also lots of other important information like services, ACLs, open/listening ports, etc., and reports any differences between the snapshots.

Downside is that it's only compatible with Win7/2008.

score 0 · Answer 5 · answered Jan 28 '11 at 22:16

if exporting the registry before the change and comparing with DIFF after didn't find the change, it's possible that the change you are making is not stored in the registry, which is where procmon comes in. Trace the activity of the proccess making the changes and you will see either the file or registry activity that is happening when the settings change is saved. Symantec Antivirus uses HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\ to store many of it's settings if that helps

Changed value in Registry

5 Answers5