60

How do I see what files/registry keys are being accessed by my application in Windows?

lospejos
  • 1,976
  • 3
  • 19
  • 35
Egor Pavlikhin
  • 17,503
  • 16
  • 61
  • 99
  • Answers regarding command-line or powershell solutions, such as whatever appears to have been used by [this WmiPrvSE.exe article](http://windows.fyicenter.com/4133_WmiPrvSE.exe_Process_on_Windows_8.html), would also be welcome. – Jim Grisham Jul 29 '22 at 23:41

4 Answers4

72

Check out Process Monitor at

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

DexTer
  • 2,043
  • 1
  • 22
  • 45
5

Microsoft Process Monitor is better at this job. I've tried other tools but they are not as good. And MS is most trustworthy in this case, since it is made by the OS developer anyway

user3513890
  • 51
  • 1
  • 1
1

I haven't tried it myself but someone should try Regmon and maybe post how it goes.

Paul
  • 19
  • 1
-1

Check out process explorer: http://technet.microsoft.com/de-de/sysinternals/bb896653.aspx

maxmc
  • 4,218
  • 1
  • 25
  • 21
  • 1
    Process Explorer doesn't do registry watching. You want Process Monitor, as mentioned above. – ChrisV Oct 02 '09 at 13:24
  • 1
    According to MS Process Explorer does do registry: "Process Explorer Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process." – Justin Emlay Oct 03 '13 at 23:04