Monitor registry using C++

Question

I want to monitor when a key is changed/added/deleted to the registry whenever application is being installed or removed. I have tested the sample code from the msdn(link) and it works fine.

But the problem is that it does not tell me which key has actually been modified/added/deleted. How can i retrieve this information using c++?

Answer 1

There are only 3 ways, none of which is both easy and adequate:

• RegNotifyChangeKeyValue: Doesn't give you the info you need, but is very easy to use.

• EVENT_TRACE_FLAG_REGISTRY which is part of Event Tracing for Windows which is what ProcMon uses. It works well, but it's quite difficult to use.
  I'm not sure exactly how to use it myself, but if I figure it out I'll post it here.

• CmRegisterCallback: Requires kernel-mode driver, which is a pain in 64-bit.
  But it's the most perfect solution otherwise.