how to use process monitor to track registry changes

If the altitude is not what you set and you did not restart the machine, please restart your machine.You probably do not see anything but zeroes in the Hard Faults/sec column.

If not you should be able to just start procmon.įrom an elevated command prompt, run the command “fltmc instances” and verify that the procmon drivers are running at the altitude that you set. If you have already started procmon before doing these changes, you will need to restart the machine. You will have to uncheck “inherit permissions” in order to be able to set them at the Process Monitor Instance level. Reason being that procmon will try to change its value back right away.

You must also set the security on the “Process Monitor xy Instance” key and add deny rights for everyone for “delete” and “set value”. Ĭhange the Altitude value to lower than your driver altitude. Run regedit and navigate to registry key. This key location can change with each version of Procmon. The fllowing steps assumes that the ProcMon registry data lives in a floder called PROCMONxy. We can change the altitude of procmon with fllowing steps. We can get other allocated altitude in document Allocated Altitudes. In doing so we will be able to see all of the activity that we want from any filter driver.īy default, the altitude of procmon driver is 385200. So if you need to get Procmon’s filter to run below Low level Driver in the filter stack, we can lower the altitude of procmon driver, putting it lower in the filter stack.

Procmon is usually used to show real-time file system, Registry and process/thread activity, but you do not get to see the activity of things such as virus scanners and unifiltr because they happen at a lower level than the procmon filter.Īs we know,every minifilter drier must have a unique identifier called altitude, which defines position relative to other minifilter drivers in the I/O stack when the minifilter driver is loaded.

How to use process monitor to track registry changes