Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there an application to track the changed reg key value, once we change setting in application?

share|improve this question

Process Monitor will let you track Registry activity in realtime.

share|improve this answer
give a lot of information which is not helpful to find the changed value, i am changing one of symantec setting and i need to know what is changing in registery, in order to make a reg key and import it to other clients – Eddy Sep 3 '10 at 1:42

I use regshot (freeware) it allows to create snapshots before and after the change (for example an installation) Afterwards you can compare the snapshots and find all changes.

share|improve this answer
You could also just export the registry and compare with diff. – Zoredache Aug 23 '10 at 18:53
didn't work for me – Eddy Sep 3 '10 at 1:40

Process Monitor also allows a myriad of filters to be set - so you could, for example, filter by process and only see the effects from the Symantec process you mentioned.

And if you're not sure which process to monitor, Process Explorer (another SysInternals tool) lets you drag a bullseye over an application to identify the process in the Process Explorer window.

share|improve this answer

Microsoft's Attack Surface Analyzer is a free (beta at the moment) tool that takes snapshots and compares not only registry keys but also lots of other important information like services, ACLs, open/listening ports, etc., and reports any differences between the snapshots.

Downside is that it's only compatible with Win7/2008.

share|improve this answer

if exporting the registry before the change and comparing with DIFF after didn't find the change, it's possible that the change you are making is not stored in the registry, which is where procmon comes in. Trace the activity of the proccess making the changes and you will see either the file or registry activity that is happening when the settings change is saved. Symantec Antivirus uses HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\ to store many of it's settings if that helps

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.