5

Is there an application to track the changed reg key value, once we change setting in application?

5 Answers 5

5

Process Monitor will let you track Registry activity in realtime.

1
  • give a lot of information which is not helpful to find the changed value, i am changing one of symantec setting and i need to know what is changing in registery, in order to make a reg key and import it to other clients
    – Eddy
    Sep 3, 2010 at 1:42
2

I use regshot (freeware) it allows to create snapshots before and after the change (for example an installation) Afterwards you can compare the snapshots and find all changes.

2
  • You could also just export the registry and compare with diff.
    – Zoredache
    Aug 23, 2010 at 18:53
  • didn't work for me
    – Eddy
    Sep 3, 2010 at 1:40
1

Process Monitor also allows a myriad of filters to be set - so you could, for example, filter by process and only see the effects from the Symantec process you mentioned.

And if you're not sure which process to monitor, Process Explorer (another SysInternals tool) lets you drag a bullseye over an application to identify the process in the Process Explorer window.

0

Microsoft's Attack Surface Analyzer is a free (beta at the moment) tool that takes snapshots and compares not only registry keys but also lots of other important information like services, ACLs, open/listening ports, etc., and reports any differences between the snapshots.

Downside is that it's only compatible with Win7/2008.

0

if exporting the registry before the change and comparing with DIFF after didn't find the change, it's possible that the change you are making is not stored in the registry, which is where procmon comes in. Trace the activity of the proccess making the changes and you will see either the file or registry activity that is happening when the settings change is saved. Symantec Antivirus uses HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\ to store many of it's settings if that helps

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .