Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I'm installing a software on Windows and I want to see all the changes it has made during its installation, what is the easiest way to keep track of system changes. The change could happen in program/system files or registry etc., Is there a tool that tracks that changes? This could be useful in, for example, a patch installation where an administrator may want to keep track of all the changes it has made.

share|improve this question
Practically a duplicate of Program to snapshot changes made during an install? – Dan Dascalescu Dec 3 '12 at 3:42
There seems to be a new capture tool called Scalable Smart Packager CE. I have not tested this tool thoroughly. Scalable, Vendor link. – Stein Åsmul Apr 29 '15 at 12:26
up vote 2 down vote accepted

Sysinternal's Process monitor might come in handy here. Though it could be a bit too verbose, you can filter out other processes and tweak until it works best for you. Launch it and scan, then start your install and stop once it's done.

Process Monitor

There might be other Free solutions that are specific for the launched binary install, but I'm not aware of them.

Quick Update
I agree with Evan, at least for the registry, if it's too verbose you might want to run an export before and after the install. Windows 2003 Support tools come with windiff.exe (an old favorite for looking up differences in the registry - between two .reg files).

share|improve this answer

You want to do the "poor man's snapshot". I do this fairly frequently when building my own MSIs for third-party software w/ WIX.

Process Monitor is probably a bit too verbose for what you're trying to do. You might try making a "snapshot" of the registry using something like:


And then again afterward so you can compare.

With the filesystem, I've used the freeware utility "FileList" (see to generate a "before" and "after" snapshot of the filesystem.

Modifications inside existing files are problematic. You might have to take an initial snapshot, locate files that have been modified, then roll-back (I normally use a VM and the built-in disk snapshot functionality for roll-back) and take a "before" snapshot of each file that you know is going to be modified to compare to the "after" version.

Remember that capturing what changes isn't the same thing as capturing the logic of the setup program. Where possible, reverse-engineering the setup program is preferred to just trying to capture what changes. You may miss nuances that you aren't seeing because of circumstances of your snapshot computer's configuration.

The old WinInstall 2003 LE that came w/ Windows 2000 Server does a fairly decent job generating these kinds of snapshots for reference purposes, but the MSIs it generates are abyssmal. (I gave up using it and have started just doing snapshots myself "by hand" as I've described above.)

share|improve this answer
It seems WinInstall has been overhauled, as they put it, to become Scalable Smart Packager CE. – Stein Åsmul Apr 29 '15 at 12:51

Check out Total Uninstall

It will watch from before and after an install and tell you exactly what that program did.

share|improve this answer

You can use Installshield product to open the package, and so you will know what it will do without having to install it for real. This product also integrates a capture tool to do a snapshot before/after

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.