Under the Details section, you will see the registry key that is being modified right next to the “Registry Key” heading. As soon as you select the policy, you will see a bunch of information about that particular object on the right panel.ģ. For instance, I want to modify the biometric usage policy. First, head over to the group policy search website, and use the search bar to find the policy you want to modify.Ģ. This website not only gives a variety of details about each and every available group policy object but also shows what registry changes are made when you modify a policy object.ġ. Not sure if it's a bug, misinterpretation of what it can do or operator error.Microsoft has a dedicated website to search and find information about group policy objects. That didn't surprise me, since it was mentioned RFA must run in same mode as apps to monitor.īut when starting RFA in Admin mode, the options are grayed out to Browse / select a new process (installer) that isn't yet running, to monitor for reg changes.ĪFAIK, it is then impossible to select a process (installer) to monitor, that's not yet running. It accepted that.īut it didn't log anything during the selected app's installation or at the app's launch. Started it in NON admin mode, went to main menu, File > Start New Process, then browsed / selected a typical installer. I got / ran the 32 bit RegFromApp (first got the 64 bit ver says must have 32 bit RFA ver for monitoring 32 bit apps). Since most installers in Vista run in Admin mode, that would mean running RFA in admin. The documentation mentions for Vista (I think), you must run RFA at the same authority level as the app to be monitored. I think the key here is, you must select a process from the RegFromApp UI. You can copy & paste the desired values to another Registry file, or alternatively, you can save the entire Registry changes into a. After clicking Ok, each time that the selected process writes a value into the Registry, the main window of RegFromApp will display the written value in Windows. In order to start using it, simply run the executable file - RegFromApp.exeĪfter running it, select the process that you want to inspect, and click Ok.

RegFromApp doesn't require any installation process or additional dll files.

Process monitor registry changes