Registry watch cannot detect changes [Create, Delete, or Modify] when monitoring: \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
Creating registry watch from Windows_Tempalte_Policy to monitor the "CurrentControlSet" does not detect registry changes.
Create registry watch to monitor changes under the tree: \HKEY_LOCAL_MACHINE\System\ControlSet*\*
NOTE: The “CurrentControlSet” is considered a link in the registry rather than a key. It points to one of the ControlSetnnn keys depending on which is being used by the system. The majority of systems may point to ControlSet001, however, it could point to 002, 003, etc. So by using “ControlSet*” instead of “CurrentControlSet”, you get all the possible places CurrentControlSet could be pointing at.
Windows 2008 R2 Server
Imported Document Id
This is machine translated content
Login to Subscribe
Please login to set up your
For security reasons, your link to this document has expired. Please click on the attachment link to access this file.
The attachment that you are looking for no longer exists.
There has been an issue retrieving your attachment. Please try again.
Didn't find the article you were looking for? Try these resources.