VBS code to monitor registry changes through WMI_javascript skills

Google "VBS Monitoring Registry", the top 5 are all the same code, I checked, the source is Hey, Scripting Guy! Blog on an article titled "How Can I Monitor Changes to a Registry Key?" How shameless.


I don’t have time to translate the article, so I’ll post the code:

Copy the code The code is as follows:

strComputer = "."

Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootdefault")
Set colEvents = objWMIService.ExecNotificationQuery _
( "SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _

"KeyPath='SOFTWARE\Microsoft\Windows\CurrentVersion\Run'")
Do
Set objLatestEvent = colEvents.NextEvent
Wscript.Echo Now & ": The registry has been modified."

Loop In fact, there are 4 classes in WMI that can monitor the registry, namely

• RegistryEvent
• RegistryTreeChangeEvent
• RegistryKeyChangeEvent
• RegistryValueChangeEvent

You can tell what each class does by looking at the class name. The above code uses RegistryKeyChangeEvent, which is the registry key change event.

I don’t want to talk about the usage of WMI events here, which is very basic; I don’t want to translate the reference documents. If you can’t understand this simple English, there is no need to use WMI. I think the most difficult part of WMI is that there are too many classes in it, and many times I don’t know which class to use to achieve the desired function. Now, it is clear which class to use and this article can come to an end.

Reference link: Registering for System Registry Events

Original text: http://demon.tw/programming/vbs-wmi-monitor- changes-to-a-registry-key.html