H C wrote: > There is an API for monitoring the Registry, though I > don't know of any tools that do. > > Win2K does have the capability to monitor the > Registry...enable auditing for File and Object Access, > and then set the SACLs for the Registry through regedt32.exe.
RegMon by SysInternals is pretty cool. It gives you a real time view of all the registry keys being accessed and you can learn quite a lot from it. (Reverse Engineer, etc). Even has filters to filter out the noisy programs, or concentrate on a particular program your interested in. http://www.sysinternals.com/ntw2k/source/regmon.shtml Regards, Chris.
