3

I'm looking for a possibility to execute a script in case a particular registry key is going to be created or modified. In the Windows Taks Scheduler there is a way to execute scripts triggered by system/application events. But I could not find one for registry changes.

Does anyone have a clue how I can implement this?

Improve this question
3
  • 1
    Hi, You can't trigger on that, you will need to make a script that will be run at interval, a script like shown there; stackoverflow.com/questions/9604276/…
    – yagmoth555 ♦
    Oct 12, 2018 at 16:34
  • What do you want to do once the registry is changed? It may not be possible to run a scheduled task based on registry changes, but there may be alternatives to achieve the desired results (like @yagmoth555 suggested, a time-based task or any number of alternatives).
    – sippybear
    Oct 12, 2018 at 17:34
  • 1
    If you have or enable auditing for Object Access > Audit Registry, you can create a scheduled task to trigger on the audit event, and create a custom event Xml filter for the event criteria (Event Id, ObjectName, AccessMask, etc).
    – Greg Askew
    Oct 13, 2018 at 14:31

1 Answer 1

Reset to default
1

You can trigger on those changes by auditing the registry key that you are concerned about. But it's important to distinguish between registry keys being created / deleted and registry values being changed, because there are different events logged for those.

First, run auditpol.exe /get /category:"Object Access" and note whether "Registry" as Success & Failure enabled (you're mostly concerned with Success of course). If it's not, then you'll need to make you enable this on the domain controller via GPO or in the local security policy of the server/workstation.

Once auditing for the registry is activated, you will need to enable auditing on the registry key in regedit.exe. Simply right-click the key and select Permissions -> Advanced -> Auditing and audit the necessary actions for the user Everyone. I generally prefer to audit more than less.

Going forward, when registry values are changed you'll see event 4657, and when keys are added/deleted you'll see event 4663, e.g.:

    An attempt was made to access an object.

       Subject:
        Security ID:        DOMAIN\user
        Account Name:       user
        Account Domain:     DOMAIN
        Logon ID:       0x722be21

    Object:
        Object Server:  Security
        Object Type:    Key
        Object Name:    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\SomeApplication\SomeKey
    Handle ID:  0x100

Process Information:
    Process ID: 0x650
    Process Name:   C:\Windows\regedit.exe

Access Request Information:
    Accesses:   DELETE

    Access Mask:    0x10000

You can then trigger on those events in the task scheduler.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .