Jon

Jon

  • NA
  • 1
  • 0

How to find the process which accessed a registry key?

May 18 2010 3:42 PM

Hi, im trying to find out the process name/id which caused a registry key change?
Im using an example from codeproject as my basic template to build up from. This allows me to detect registry key changes:
http://www.codeproject.com/KB/system/registrymonitor.aspx?msg=3475799#xx3475799xx
I've also borrowed a class which helps getting the process owner (as you cant access handles of System processes?) from:
http://www.sellsbrothers.com/askthewonk/secure/default.aspx?content=howcanigetthesecurityprin.htm
I thought i could just equate the intPtr of the registry hives to  the process handle of current processes (if i manually changed registry values to test) but it doesn't appear to work?
Thanks in advance