How to use WMI to monitor registry key change events

This article describes an All-In-One Code Framework sample that is available for download. The sample demonstrates how to monitor the following registry key change events:

• Rename or delete a registry key
• Add, rename, or delete a sub key of a registry key
• Add, rename, edit, or delete a value of a registry key

Difficulty level

Download information

To download this code sample, click one of the following links:

 

Technical overview

The System Registry provider creates several methods and event classes that allow Windows Management Instrumentation (WMI) scripts or applications to interact with the registry. You can subscribe to several registry events. For example, you can subscribe to the changes in a registry key, in a sub key, or in a registry key value. This sample code uses the RegistryKeyChangeEvent class that represents changes in a specific registry key.


To subscribe to RegistryKeyChangeEvent events, create a WqlEventQuery object and use the ManagementEventWatcher class to watch these events. When a change occurs, the EventArrived event of the ManagementEventWatcher class is raised.


Notes

• RegistryEvent classes (for example, the RegistryKeyChangeEvent class) do not support changes in the "HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" hives.
• The WMI event does not return the changed value and changed type. The WMI event only shows that there is a change. The properties that you can get from the event are Hive, KeyPath, SECURITY_DESCRIPTOR and TIME_CREATED.

For more information about how to create and deploy the sample application, see the Readme.txt file that is included in the download package.

Technology category

• Windows Base

Languages

This code sample contains the following programming languages:

Prerequisites

• To run this sample code, you must have Visual Studio 2010 and .NET Framework 4 installed.

For more information about the RegistryKeyChangeEvent class, visit the following Microsoft website:

General information about the RegistryKeyChangeEvent class

For more information about how to modify the system registry, visit the following Microsoft website:

How to modify the system registry

Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.