Tools regmon

The best way to become familiar with Process Monitor's features is to read through the help file and then visit each of its menu items and options on a live system. Run now from Sysinternals Live. Skip to main content.

This browser is no longer supported. Plus, visit the Microsoft Subnet web site for more news, blogs, podcasts. Subscribe to all Microsoft Subnet bloggers. Sign up for the bi-weekly Microsoft newsletter. Follow All Microsoft Subnet bloggers on Twitter. Julie is also author of Building an Extranet Wiley, Here are the latest Insider stories.

Sysmon for Linux Sysmon is now available as an open source project for Linux. Candid talk from the man behind your favorite Windows tools Mark talks with Larry Seltzer about the history and future of Sysinternals. Autoruns v Process Monitor v3. Sysmon v For each registry access, the Regmon displays processes that are performed, and the access time along with the type and result of the access.

Now, the question is how this tool can be used to troubleshoot a registry-related issue. Basically there are two troubleshooting techniques. By verifying the last thing that the application did before it failed, from the Regmon trace. This can help you trace out the problem for its failure. In order to use the first approach, run Regmon first and then run the suspected application. When the failure occurs, go back to Regmon and stop logging.

Go to the end of the activity log and find the last operation that was performed by the application before it failed. From the last line you need to examine the registry keys it referenced. Many a time, this helps to resolve the problem. The second approach can be used when the application fails on one system and works on another. Capture the Regmon trace of the application on the working and failing systems and save the output to a log file.

After this, you need to open both the logs in Microsoft Excel. Please take care to delete the first 3 columns, if not the comparison will show all the lines. Now, compare the logs. This does not indicate a buffer-overflow exploit in the application, instead it is used by the configuration manager to inform an application that the buffer that it has specified to store the registry value is too small to hold the value.