Process Monitor is one of the most impressive tools that you can have in your toolkit, as there is almost no other way to see what an application is actually doing under the hood.

Wrapping Up and Using the Tools Together.

Analyzing and Managing Your Files, Folders, and Drives.

Using PsTools to Control Other PCs from the Command Line.

Using BgInfo to Display System Information on the Desktop.

Using Autoruns to Deal with Startup Processes and Malware.

Using Process Monitor to Troubleshoot and Find Registry Hacks.

Using Process Explorer to Troubleshoot and Diagnose.

What Are the SysInternals Tools and How Do You Use Them?.

Top link $code or die nice explanation of the behind the scenes workings of this program. Re: Re: Re: Monitoring Windows Registry Changes Lots of other good software there too, and a lot of it comes with source code. The free version is available at Sysinternals. Re: Re: Monitoring Windows Registry Changes Why reinvent this wheel, then again why not :-) You can find the site here Sorry they do charge but the do have a free demo and, well you know. Hi this is not a perl solution but a program called Regmon works very well.

Take a look at the Win32::Registry and Win32::Daemon from Roth Consulting (which appears to be down right now). Then every hour (or what ever resolution you need), I would have it scan the registry and look for differences, and have the script e-mail a report. I would create a windows service that on boot would make a copy of the registy (keys and values).

The only thing I can add is you could run the monitor via mstask (scheduler). You could also turn Auditing on the registry and montitor the Event Logs, hopefully leveraging any existing Event Log Security monitoring you may have (using Win32::EventLog, of course :)Ĭ-era has good suggestions.

Sysinternals registry monitor