How to use WMI to monitor registry key change events

This article describes an All-In-One Code Framework sample that is available for download. The sample demonstrates how to monitor the following registry key change events:
  • Rename or delete a registry key
  • Add, rename, or delete a sub key of a registry key
  • Add, rename, edit, or delete a value of a registry key

Difficulty level

Download information

To download this code sample, click one of the following links:


Technical overview

The System Registry provider creates several methods and event classes that allow Windows Management Instrumentation (WMI) scripts or applications to interact with the registry. You can subscribe to several registry events. For example, you can subscribe to the changes in a registry key, in a sub key, or in a registry key value. This sample code uses the RegistryKeyChangeEvent class that represents changes in a specific registry key.

To subscribe to RegistryKeyChangeEvent events, create a WqlEventQuery object and use the ManagementEventWatcher class to watch these events. When a change occurs, the EventArrived event of the ManagementEventWatcher class is raised.

  • RegistryEvent classes (for example, the RegistryKeyChangeEvent class) do not support changes in the "HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" hives.
  • The WMI event does not return the changed value and changed type. The WMI event only shows that there is a change. The properties that you can get from the event are Hive, KeyPath, SECURITY_DESCRIPTOR and TIME_CREATED.
For more information about how to create and deploy the sample application, see the Readme.txt file that is included in the download package.

Technology category

  • Windows Base


This code sample contains the following programming languages:
LanguageProject Name
Visual C#CSMonitorRegistryChange
Visual Basic.NETVBMonitorRegistryChange


  • To run this sample code, you must have Visual Studio 2010 and .NET Framework 4 installed.

What is All-In-One Code Framework?

All-In-One Code Framework shows most Microsoft development techniques by using code samples in different programming languages. Each example is carefully selected, composed, and documented to show one common code scenario. For more information about All-In-One Code Framework, visit the following Microsoft website:

How to find more All-In-One Code Framework samples

To find more All-In-One Code Framework samples, search for "kbcodefx" together with related keywords on the Microsoft support Web site. Or, visit the following Microsoft website:
For more information about the RegistryKeyChangeEvent class, visit the following Microsoft website: For more information about how to modify the system registry, visit the following Microsoft website:
Rapid publishing disclaimer
Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Αναγνωριστικό άρθρου: 2494270 - Τελευταία αναθεώρηση: 01/28/2011 03:54:00 - Αναθεώρηση: 1.0

  • kbcodefx kbinfo kbrapidpub kbnomt kbsurveynew atdownload KB2494270