To do this, click the Filter menu and select Filter. Start Process Monitor and set a filter for the registry key that you want to monitor. The steps you have outlined in your previous message are correct for using this tool to monitor registry changes. To find what is changing the value of the AutoConfigURL registry key, you can use the Microsoft Sysinternals Process Monitor tool. I’d be more than happy to help you with your query Thank you for your question and reaching out. Manually checking every event is time-consuming, inefficient, and practically impossible.Hi. These steps need to be repeated for all the registry keys to audit changes in registry permissions. You can double-click on the event to view Event Properties.

Search for Event ID 4670, this identifies Windows registry permission changes. In Event Viewer window, go to Windows Logs ➔ Security logs.Ĭlick on Filter current log under Action in the right panel. Permissions: Select Full Control check box.Ĭlick Apply, then OK, and close the console. Right-click the key and select Permissions.Ĭlick Advanced on the Permissions for dialog box and click Add. In the Registry Editor navigate to the key you want to audit. Step 2: Enable auditing through Registry EditorĬlick Start, Run and type Regedit and press Enter.

To enforce these changes throughout the domain, run the command gpupdate /force, in the Run console. Under Audit Policy, turn auditing on for Success and failure events of Audit Object Access policy.Ĭlick Apply and OK to close Properties window. The Audit Policy lists all of its sub-policies in the right panel, as shown in the figure below. Navigate to Computer Configuration ➔ Windows Settings ➔ Security Settings ➔ Local Policies ➔ Audit Policy. Navigate to Forest ➔ Domain ➔ Your domain ➔ Domain Controllers.Ĭreate a new GPO and link it to the domain containing the registry to be monitored, or edit any existing GPO that is linked to the domain to open the Group Policy Management Editor. Under Manage, select Group Policy Management and launch the Group Policy Management console. Launch Server Manager in your Windows Server instance. With native AD auditing, here is how you can monitor Windows registry permission changes:

Process monitor registry changes