Receive notification when RegistryKey Value was changed

Question

I want a notification when a specific RegistryKey in HKEY_CURRENT_USER is changed. So far I tried this via WMI with no success:

var query = new WqlEventQuery(string.Format(
"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='{0}' AND KeyPath='{1}' AND ValueName='{2}'",
                hive, keyPath.Replace("\\","\\\\"), valueName));
_watcher = new ManagementEventWatcher(query);
_watcher.Scope.Path.NamespacePath = @"root\default";
_watcher.EventArrived += (sender, args) => KeyValueChanged();
_watcher.Start();

(Error was "Not found")

My second approach was using the WBEM Scripting COM component with the intent to port the example from http://msdn.microsoft.com/en-us/library/aa393042(VS.85).aspx to c# but I didn't find any usage samples for the WBEM COM in c#

I found this http://www.codeproject.com/KB/system/registrymonitor.aspx class, but it didn't fit my needs as this class only monitors the whole key and I only want a notification when a specific value (specified via the ValueName in the samples above) gets changed.

EDIT: If you change the Hive to HKEY_CURRENT_USER in the msdn vbscript example, it stops working. I couldn't find anything about this behaviour but a link from 2003

EDIT2: Changes to the HKEY_CLASSES_ROOT and HKEY_CURRENT_USER hives are not supported by RegistryEvent or classes derived from it, such as RegistryValueChangeEvent. (MSDN)

I believe you can modify the code-project code to use multiple wait handles/monitors to all least tell which key has been changed. I am not sure what the implications of n monitors are though -- doesn't seem so bad: http://blogs.technet.com/b/markrussinovich/archive/2009/09/29/3283844.aspx :-) — , Nov 20 '10 at 19:11

score 15 · Accepted Answer · edited Sep 11 '12 at 22:35

15

I finally solved the problem and got the WMI query version to work:

var currentUser = WindowsIdentity.GetCurrent();
var query = new WqlEventQuery(string.Format(
"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_USERS' AND KeyPath='{0}\\\\{1}' AND ValueName='{2}'",
currentUser.User.Value, keyPath.Replace("\\","\\\\"), valueName));
_watcher = new ManagementEventWatcher(query);
_watcher.EventArrived += (sender, args) => KeyValueChanged();
_watcher.Start();

I found this "hack" at http://www.codeproject.com/Messages/2844468/Monitoring-HKEY_CURRENT_USER.aspx

edited Sep 11 '12 at 22:35

sfm

609
10
17

answered Nov 20 '10 at 20:01

RoXX

1,664
1
24
28

Did you run into an issue where this event would only fire once? – pfinferno Jul 19 '23 at 17:37

score 0 · Answer 2 · answered Nov 20 '10 at 16:43

0

Uploaded to pastbin a nice class that does it. Hope it fits your needs.

http://www.csharp.pastebin.com/0reFh6v2

answered Nov 20 '10 at 16:43

byte_slave

1,368
1
12
24

2

This looks like the RegistryMonitor class from codeproject which as I mentioned in my question does not fit my needs because it notifies if any value in the key changes and not only if a specific one changes... – RoXX Nov 20 '10 at 16:50
@RoXX can't you just iterate through the values that changed and see if the one you wanted did? – Moo-Juice Nov 20 '10 at 17:35
1

I could but there are a lot of other values which change and it would be nice if I could filter them out at a lower level like with the wmi query, I'm looking for a nicer solution. – RoXX Nov 20 '10 at 17:47
I've reviewed the codeproject class again and it doesn't provide any information on which ValueName has changed in its event and so I would have to manually check if my key has changed and this would have a huge performance impact which makes this aproach useless for me – RoXX Nov 20 '10 at 18:01

Receive notification when RegistryKey Value was changed

2 Answers2

Linked