Monitoring NT registry and event log changes

I need to know if there have been any changes to the Windows NT registry or event log since I started running a process. Is there any way I can do this simply ? What I would like to do is to get a handle to the registry and a handle to the event log. These handles would somehow know when there were changes which I could wait for. Any ideas ?
shimon_crownAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

jhanceCommented:
Define "do this simply".  

There is no automatic NT function which "watches" the event log and registry for changes.  You will need to write functions to check the state of the registry keys you are interested in and the last line of the event log when your app starts up and save those items away somewhere.  Then when you need to do your check, go back and compare your original state to the current state.
0
shimon_crownAuthor Commented:
This is the difficult way I had already thought of !! Does anybody else out there have an idea.
0
alexoCommented:
The is a program that does what you need.
available (with source) from http://www.ntinternals.com/ntregmon.htm

0
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

jhanceCommented:
alexo,

NTREGMON is NOT what he needs.  I think you should read the description of the program.  NTREGMON is a utility which will intercept registry calls and display (as they happen) registry calls in the system.  Doing what it does is even more difficult that what shimon_crown asked for and still doesn't tell if something has changed, it just reports activity.
0
shimon_crownAuthor Commented:
I think that NTREGMON may be the right direction. While it does give a lot more information than I ask I shall have to look at the source code to see if it is simpler than jhance's suggestion.

BTW by simple I meant not having to know the keys in advance.

Thanks for your help. I shall e-mail the winner so he can re-enter his answer for the points.

I am still open to more suggestions on this point.

0
jhanceCommented:
So let me get this straight.  You are looking for a "simple" way to determine if ANY registry key has changed from some start time until you check it?  It that right?
0
shimon_crownAuthor Commented:
Exactly. This is a medical application and the customer is insistent that the registery is untampered.
0
jhanceCommented:
You got to bound this in some way.  NT changes registry keys all the time in the normal course of running itself.
0
tflaiCommented:
Get NTRegMon from "www.ntinternals.com".  It comes with complete source code also.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tflaiCommented:
By the way, NTRegMon is a GUI/device driver combo that hooks to system call to watch all registry-related activies.
0
alexoCommented:
Hmmm... isn't the accepted answer identical to what I have suggested (third entry from the top)?

Just curious...

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Development

From novice to tech pro — start learning today.