How to use WMI to monitor registry key change events
- Rename or delete a registry key
- Add, rename, or delete a sub key of a registry key
- Add, rename, edit, or delete a value of a registry key
Download informationTo download this code sample, click one of the following links:
Technical overviewThe System Registry provider creates several methods and event classes that allow Windows Management Instrumentation (WMI) scripts or applications to interact with the registry. You can subscribe to several registry events. For example, you can subscribe to the changes in a registry key, in a sub key, or in a registry key value. This sample code uses the RegistryKeyChangeEvent class that represents changes in a specific registry key.
To subscribe to RegistryKeyChangeEvent events, create a WqlEventQuery object and use the ManagementEventWatcher class to watch these events. When a change occurs, the EventArrived event of the ManagementEventWatcher class is raised.
- RegistryEvent classes (for example, the RegistryKeyChangeEvent class) do not support changes in the "HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" hives.
- The WMI event does not return the changed value and changed type. The WMI event only shows that there is a change. The properties that you can get from the event are Hive, KeyPath, SECURITY_DESCRIPTOR and TIME_CREATED.
- Windows Base
LanguagesThis code sample contains the following programming languages:
- To run this sample code, you must have Visual Studio 2010 and .NET Framework 4 installed.
What is All-In-One Code Framework?All-In-One Code Framework shows most Microsoft development techniques by using code samples in different programming languages. Each example is carefully selected, composed, and documented to show one common code scenario. For more information about All-In-One Code Framework, visit the following Microsoft website:
How to find more All-In-One Code Framework samplesTo find more All-In-One Code Framework samples, search for "kbcodefx" together with related keywords on the Microsoft support Web site. Or, visit the following Microsoft website:
Rapid publishing disclaimerMicrosoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.
Αναγνωριστικό άρθρου: 2494270 - Τελευταία αναθεώρηση: 01/28/2011 03:54:00 - Αναθεώρηση: 1.0
- kbcodefx kbinfo kbrapidpub kbnomt kbsurveynew atdownload KB2494270