Windows Developer Power Tools

15.3 Seeing What’s Being Accessed in Your Registry with Regmon

Registry access can be critical for applications, especially if you’re trying to deal with portions of the registry that have been locked down by access control lists, or if you’re dependent on a component you didn’t write. You might not have a clear picture of where registry-access attempts fail or of the reasons causing those failures.

Regmon from Sysinternals gives you a real-time view into all registry accesses, enabling you to see exactly how your software and related components are using the registry.

Regmon at a Glance
Tool	Regmon (Registry Monitor)
Version covered	7.02
Home page	http://www.sysinternals.com/Utilities/Regmon.html
Power Tools page	http://www.windevpowertools.com/tools/72
Summary	Provides a real-time display of all registry-access attempts. Highly configurable, extremely flexible, and uses the same general user interface as other great Sysinternals tools.
License type	Freeware; can’t be redistributed without specific permission, can’t use for customer support (see web site for details)
Online resources	Forum
Related tools in this book	Filemon, TCPView, ProcessExplorer, Unlocker

Getting Started

Regmon is a simple executable that you can drop into any convenient folder. It requires Load Driver and Debug privileges to execute, so you can’t run it as a basic user. Regmon runs on Win9x/Me and all x86 versions (32- and 64-bit) ...