How can I monitor registry activity during logon and logoff?

A. The Regmon tool, which you can download at http://www.sysinternals.com , is handy for monitoring registry access and modification. However, it runs as part of the interactive desktop, which means when you log off, the Regmon process terminates. To solve this problem, combine Regmon with PsExec (which you can download at http://www.sysinternals.com/utilities/psexec.html) to configure Regmon to run under the local system in the background. This approach allows the Regmon process to survive a logon or logoff. To configure Regmon, open a command line, and type

C:>psexec -i -s -d "c:program filesmiscregmon.exe"

The -i switch instructs PsExec to run Regmon as interactive; the -s switch tells it to run under the local system; and the -d switch tells it to launch the application and not wait for it to terminate.

After a user logs off and logs back on, the Regmon window will appear again and will have captured all activity. (Make sure that you don't close the Regmon application before logging off!) You can use PsExec to run any other applications that need to survive a logoff and logon.