Regmon

RegMon is a tool used in system administration, computer forensics, and application debugging. RegMon was primarily created by Mark Russinovich [ [http://blogs.technet.com/markrussinovich/about.aspx TechNet Blogs ] ] and Bryce Cogswell, employed by SysInternals prior SysInternals being bought out by Microsoft in 2006.

RegMon monitors and records all actions attempted against the Microsoft Windows Registry. RegMon can be used to detect failed attempts to read and write registry keys. It also allows for filtering on specific keys, processes, process IDs, and values.

RegMon and it's Sister Application FileMon have been replaced in Windows Vista by Process Monitor [ [http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Regmon.mspx RegMon for Windows ] ] [ [http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Process Monitor ] ] .

References