Solved

Monitoring NT registry and event log changes

Posted on 1998-02-22
11
221 Views
Last Modified: 2013-12-04
I need to know if there have been any changes to the Windows NT registry or event log since I started running a process. Is there any way I can do this simply ? What I would like to do is to get a handle to the registry and a handle to the event log. These handles would somehow know when there were changes which I could wait for. Any ideas ?
0
Comment
Question by:shimon_crown
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
11 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 1411457
Define "do this simply".  

There is no automatic NT function which "watches" the event log and registry for changes.  You will need to write functions to check the state of the registry keys you are interested in and the last line of the event log when your app starts up and save those items away somewhere.  Then when you need to do your check, go back and compare your original state to the current state.
0
 

Author Comment

by:shimon_crown
ID: 1411458
This is the difficult way I had already thought of !! Does anybody else out there have an idea.
0
 
LVL 11

Expert Comment

by:alexo
ID: 1411459
The is a program that does what you need.
available (with source) from http://www.ntinternals.com/ntregmon.htm

0
PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

 
LVL 32

Expert Comment

by:jhance
ID: 1411460
alexo,

NTREGMON is NOT what he needs.  I think you should read the description of the program.  NTREGMON is a utility which will intercept registry calls and display (as they happen) registry calls in the system.  Doing what it does is even more difficult that what shimon_crown asked for and still doesn't tell if something has changed, it just reports activity.
0
 

Author Comment

by:shimon_crown
ID: 1411461
I think that NTREGMON may be the right direction. While it does give a lot more information than I ask I shall have to look at the source code to see if it is simpler than jhance's suggestion.

BTW by simple I meant not having to know the keys in advance.

Thanks for your help. I shall e-mail the winner so he can re-enter his answer for the points.

I am still open to more suggestions on this point.

0
 
LVL 32

Expert Comment

by:jhance
ID: 1411462
So let me get this straight.  You are looking for a "simple" way to determine if ANY registry key has changed from some start time until you check it?  It that right?
0
 

Author Comment

by:shimon_crown
ID: 1411463
Exactly. This is a medical application and the customer is insistent that the registery is untampered.
0
 
LVL 32

Expert Comment

by:jhance
ID: 1411464
You got to bound this in some way.  NT changes registry keys all the time in the normal course of running itself.
0
 
LVL 4

Accepted Solution

by:
tflai earned 200 total points
ID: 1411465
Get NTRegMon from "www.ntinternals.com".  It comes with complete source code also.
0
 
LVL 4

Expert Comment

by:tflai
ID: 1411466
By the way, NTRegMon is a GUI/device driver combo that hooks to system call to watch all registry-related activies.
0
 
LVL 11

Expert Comment

by:alexo
ID: 1411467
Hmmm... isn't the accepted answer identical to what I have suggested (third entry from the top)?

Just curious...

0

Featured Post

[Webinar] Learn How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial is about how to put some of your C++ program's functionality into a standard DLL, and how to make working with the EXE and the DLL simple and seamless.   We'll be using Microsoft Visual Studio 2008 and we will cut out the noise; that i…
zlib is a free compression library (a DLL) on which the popular gzip utility is built.  In this article, we'll see how to use the zlib functions to compress and decompress data in memory; that is, without needing to use a temporary file.  We'll be c…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question