Article ID: 2494270 - Last Review: January 28, 2011 - Revision: 1.0

How to use WMI to monitor registry key change events

System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.

On This Page

Expand all | Collapse all

INTRODUCTION

This article describes an All-In-One Code Framework sample that is available for download. The sample demonstrates how to monitor the following registry key change events:
  • Rename or delete a registry key
  • Add, rename, or delete a sub key of a registry key
  • Add, rename, edit, or delete a value of a registry key

Back to the top

Difficulty level

Collapse this imageExpand this image

Back to the top

Download information

To download this code sample, click one of the following links:

    


Back to the top

Technical overview

The System Registry provider creates several methods and event classes that allow Windows Management Instrumentation (WMI) scripts or applications to interact with the registry. You can subscribe to several registry events. For example, you can subscribe to the changes in a registry key, in a sub key, or in a registry key value. This sample code uses the RegistryKeyChangeEvent class that represents changes in a specific registry key.

To subscribe to RegistryKeyChangeEvent events, create a WqlEventQuery object and use the ManagementEventWatcher class to watch these events. When a change occurs, the EventArrived event of the ManagementEventWatcher class is raised.

Notes
  • RegistryEvent classes (for example, the RegistryKeyChangeEvent class) do not support changes in the "HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" hives.
  • The WMI event does not return the changed value and changed type. The WMI event only shows that there is a change. The properties that you can get from the event are Hive, KeyPath, SECURITY_DESCRIPTOR and TIME_CREATED.
For more information about how to create and deploy the sample application, see the Readme.txt file that is included in the download package.
Back to the top

Technology category

  • Windows Base
Back to the top

Languages

This code sample contains the following programming languages:
Collapse this tableExpand this table
LanguageProject Name
Visual C#CSMonitorRegistryChange
Visual Basic.NETVBMonitorRegistryChange
Back to the top

Prerequisites

  • To run this sample code, you must have Visual Studio 2010 and .NET Framework 4 installed.
Back to the top

MORE INFORMATION

What is All-In-One Code Framework?

All-In-One Code Framework shows most Microsoft development techniques by using code samples in different programming languages. Each example is carefully selected, composed, and documented to show one common code scenario. For more information about All-In-One Code Framework, visit the following Microsoft website:
http://1code.codeplex.com (http://1code.codeplex.com/)
Back to the top

How to find more All-In-One Code Framework samples

To find more All-In-One Code Framework samples, search for "kbcodefx" together with related keywords on the Microsoft support Web site. Or, visit the following Microsoft website:
All-In-One Code Framework samples (http://support.microsoft.com/search/default.aspx?query=kbcodefx)
Back to the top

REFERENCES

For more information about the RegistryKeyChangeEvent class, visit the following Microsoft website:
General information about the RegistryKeyChangeEvent class (http://msdn.microsoft.com/en-us/library/aa393040(VS.85).aspx)
For more information about how to modify the system registry, visit the following Microsoft website:
How to modify the system registry (http://msdn.microsoft.com/en-us/library/aa392388(VS.85).aspx)
Rapid publishing disclaimer
Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.

Back to the top
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.
Back to the top
Keywords: 
kbcodefx kbinfo kbrapidpub kbnomt kbsurveynew atdownload KB2494270
Back to the top