Registry Watcher C# implement RegistryKeyChangeEvent

Question

OK, I tried this and watched this. I followed my code-

// Construct the query string:HKEY_LOCAL_MACHINE
string queryString = string.Format(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' ");

WqlEventQuery query = new WqlEventQuery();
query.QueryString = queryString;
query.EventClassName = "RegistryKeyChangeEvent";
query.WithinInterval = new TimeSpan(0, 0, 0, 1);
this.Query = query;

this.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);

Unfortunately, when I call Start() it raise an exception - ManagementException and says "Unparsable query. "

score 2 · Accepted Answer · answered Aug 12 '14 at 15:27

After some workaround, I found my way to solve it once and for all with ManagementScope instead of WqlEventQuery:

ManagementScope Scope = new ManagementScope("\\\\.\\root\\default");
EventQuery Query = new EventQuery(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall'");
ManagementEventWatcher watcher = new ManagementEventWatcher(Scope, Query);
m_watcher.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived);
m_watcher.Start();

It seems to be something wrong with the way it parse the query, but now its fine.

Registry Watcher C# implement RegistryKeyChangeEvent

1 Answers1