Re: Monitoring Windows Registry Changes

in reply to Monitoring Windows Registry Changes

Depends on what depth you need to monitor. Do you need to know if there was a change? Do you need to know what the change was?

I'd play with Win32::TieRegistry, especially the

$key->RegNotifyChangeKeyValue(
      $bWatchSubtree, $iNotifyFilter, $hEvent, $bAsync );
[download]

section.

You could also turn Auditing on the registry and montitor the Event Logs, hopefully leveraging any existing Event Log Security monitoring you may have (using Win32::EventLog, of course :)

c-era has good suggestions. The only thing I can add is you could run the monitor via mstask (scheduler).

In Section Seekers of Perl Wisdom