It’s very lightweight, no background monitoring processes to worry about, but you’ll still get a warning (eventually) when something changes. Sysinternals’ BgInfo is a tiny tool which can display a vast amount of system information - and whatever Registry values you like - on your desktop wallpaper. This won’t give you a lot of detail, but you’ll at least get an idea of when a setting has changed, and can then investigate in more detail. To keep the documentation simple, I’ve used the easiest example so that an end-user understands clearly how to efficiently track registry and file system events using Process Monitor & generate the log file.The simplest form of Registry key monitoring is just to display its value occasionally. Also, don’t forget the compress (.zip) the log file first. If you’re going to send me a Process Monitor log, make sure you enable the All Events option when saving the log file. Look at the graphic below. You certainly want to zip the log file before sending it to someone.Įditor’s note: I usually suggest my clients save the log with the All events option so that the diagnosis can be more accurate. Right-click on the Logfile.PML file, click Send To, and choose Compressed (zipped) folder.Select Native Process Monitor Format (PML), mention the output file name and Path, save the file.In the Process Monitor window, select the File menu and click Save.The solution would be to simply run Notepad elevated (right-click and choose “Run as Administrator”) to be able to write to HOSTS file successfully. Solution: The log file above tells us that Notepad encountered an ACCESS DENIED error when writing to the HOSTS file. You need to do all that as quickly as you can.

This is to prevent Process Monitor from recording other unneeded data (which makes the analysis part more difficult). Similarly, turn off capturing as soon as you finish reproducing the problem. Important: Don’t take much time to reproduce the problem after enabling capturing.

Process monitor registry changes