Skip to content

TechDirectArchive

Hands-on IT, Cloud, Security & DevOps Insights

  • Home
  • About
  • Advertise With US
  • Reviews
  • Contact
  • Toggle search form
Home » Windows Server » Detect registry keys using Process Monitor using Sysinternals Tools
  • tpmbiosactivation
    Enable TPM: Determine if TPM is present Windows
  • creating the perfect grafana dashboard  main
    How to install Grafana on Ubuntu Linux Network | Monitoring
  • Slide2
    How to Setup Jenkins Pipelines Environment for Docker Container Deployment Containers
  • Screenshot 2022 03 29 at 19.47.05
    CVE-2022-22948: Patch available to address vCenter Server information disclosure vulnerability  Security | Vulnerability Scans and Assessment
  • image 9
    Fix Error 853: The remote access connection completed, but authentication failed because the certificate that authenticates the client to the server is not valid Network | Monitoring
  • install ssl certificate
    Configure SSL connection for WSUS Upstream and Downstream Servers Windows Server
  • mdm
    Delete AssignedAccess applied via MDM WMI bridge Provider Windows
  • Featured image new
    How to update the BIOS on your Dell system Security | Vulnerability Scans and Assessment

Detect registry keys using Process Monitor using Sysinternals Tools

Posted on 07/03/202028/09/2023 Christian By Christian No Comments on Detect registry keys using Process Monitor using Sysinternals Tools
Process Monitor

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry, and process/thread activity. For a tour of Sysinternals tools, please see this link. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Kindly refer to these related guides: How to download and use Windows SysInternals tools locally, how to Install Sysinternals from the Microsoft Store, What is System Monitor and how to install and use it, and how to enable Automatic Logon on Windows 10.

Its unique and powerful features makes Process Monitor a core utility in your system troubleshooting and malware hunting toolkit. This tool can be downloaded from here the folloing link.

Extract the downloaded tool and run the Procmon64.exe as shown below.

Windows registry

Next, after running the executable, agree to the Process Monitor License Agreement.

Registry keys

This will launch the Process Monitor SysInternal Tool as shown below.

System monitoring
Note: This tool is memory intensive

Below are some possibilities that are available with this tool. Here you can choose to include or exclude the program, highlight etc.

Process Monitor

Also, with the “Jump to Object (contl+J)”, you can jump directly to the registry keys associated as shown below

Windows registry

This tool is capable or has the following features

  • Capturing (Screenshots)
  • Auto scrolling
  • Filter
  • Highlight
  •  Show Process tree
  • Include Process from Windows
  • Find
  • Jump to Object
  • Show Registry Activity
  • Show File System Activity
  • Show Network Activity
  • Show Process and Trend Activity
  • Show profiling event.
Emphasizing on the show registry activities, we will have to click on a process name and select it.

Lastly, when you click on the Show Process and Trend Activity, this will apply an even filter as shown below and give the desired output on the Process Monitor window.

Find: With the find function, you can easily find the process (events) in the process monitor.

Without this, having to search in the numerous process will be cumbersome as you can see below.

Filter: With filter, you can also perform filter in order to include on your desired process on the Process Monitor UI.

Click on the filter, and enter your desired parameters. Next, click on Add, select the program to include, and click on Ok.

Since our filter included just one process, other processes were excluded as shown below.

Note: When this filter is set, you will have to manually reset it before you can perform other activities correctly again.

I hope you found this blog post helpful. If you have any questions, please let me know in the comment session.

Rate this post

Thank you for reading this post. Kindly share it with others.

  • Click to share on X (Opens in new window) X
  • Click to share on Reddit (Opens in new window) Reddit
  • Click to share on LinkedIn (Opens in new window) LinkedIn
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on Pinterest (Opens in new window) Pinterest
  • Click to share on Tumblr (Opens in new window) Tumblr
  • Click to share on Telegram (Opens in new window) Telegram
  • Click to share on WhatsApp (Opens in new window) WhatsApp
  • Click to share on Pocket (Opens in new window) Pocket
  • Click to share on Mastodon (Opens in new window) Mastodon
  • Click to share on Bluesky (Opens in new window) Bluesky
  • Click to share on Threads (Opens in new window) Threads
  • Click to share on Nextdoor (Opens in new window) Nextdoor
Windows Server Tags:Registry Keys, RegistryEditor, SysInternal, Windows 10, Windows 11, windows sysinternals tools

Post navigation

Previous Post: How to configure the FrontFace Lockdown Tool
Next Post: How to use the Process Explorer from SysInternals Tools

Related Posts

  • Configure Data Deduplication on Windows Server
    Video on how to Configure Data Deduplication on Windows Server Windows Server
  • article 1280x720.166f8634
    Configure Windows client to obtain IP Address via a DHCP Server Windows Server
  • DC creation as recommended by Microsoft
    Setup a Domain Controller as Recommended by Microsoft Windows Server
  • vtpm 1
    Enable vTPM and BitLocker HyperV VM: Fix the device that cannot use a TPM module Virtualization
  • find my device banner
    How to Enable Find My Device on Windows 11 Windows
  • Explorer Error
    How to fix an attempt was made to reference a Token that does not exist Network | Monitoring

More Related Articles

Configure Data Deduplication on Windows Server Video on how to Configure Data Deduplication on Windows Server Windows Server
article 1280x720.166f8634 Configure Windows client to obtain IP Address via a DHCP Server Windows Server
DC creation as recommended by Microsoft Setup a Domain Controller as Recommended by Microsoft Windows Server
vtpm 1 Enable vTPM and BitLocker HyperV VM: Fix the device that cannot use a TPM module Virtualization
find my device banner How to Enable Find My Device on Windows 11 Windows
Explorer Error How to fix an attempt was made to reference a Token that does not exist Network | Monitoring

Leave a Reply Cancel reply

You must be logged in to post a comment.

Microsoft MVP

VEEAMLEGEND

vexpert-badge-stars-5

Virtual Background

GoogleNews

Categories

veeaam100

sysadmin top30a

  • tpmbiosactivation
    Enable TPM: Determine if TPM is present Windows
  • creating the perfect grafana dashboard  main
    How to install Grafana on Ubuntu Linux Network | Monitoring
  • Slide2
    How to Setup Jenkins Pipelines Environment for Docker Container Deployment Containers
  • Screenshot 2022 03 29 at 19.47.05
    CVE-2022-22948: Patch available to address vCenter Server information disclosure vulnerability  Security | Vulnerability Scans and Assessment
  • image 9
    Fix Error 853: The remote access connection completed, but authentication failed because the certificate that authenticates the client to the server is not valid Network | Monitoring
  • install ssl certificate
    Configure SSL connection for WSUS Upstream and Downstream Servers Windows Server
  • mdm
    Delete AssignedAccess applied via MDM WMI bridge Provider Windows
  • Featured image new
    How to update the BIOS on your Dell system Security | Vulnerability Scans and Assessment

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,836 other subscribers
  • RSS - Posts
  • RSS - Comments
  • About
  • Authors
  • Write for us
  • Advertise with us
  • General Terms and Conditions
  • Privacy policy
  • Feedly
  • Telegram
  • Youtube
  • Facebook
  • Instagram
  • LinkedIn
  • Tumblr
  • Pinterest
  • Twitter
  • mastodon

Tags

Active Directory AWS Azure Bitlocker Microsoft Windows PowerShell WDS Windows 10 Windows 11 Windows Server 2016

Copyright © 2025 TechDirectArchive

 

Loading Comments...
 

You must be logged in to post a comment.