Code used by VBS to monitor registry changes through WMI

Google the "VBS monitoring Registry". The TOP 5 code is exactly the same. I checked it and the source is Hey, Scripting Guy! How Can I Monitor Changes to a Registry Key? Is really shameless.


I have no time to translate the article. paste the Code:
Copy codeThe Code is as follows:
StrComputer = "."

Set ob1_miservice = GetObject ("winmgmts: \" & strComputer & "\ root \ default ")
Set colEvents = obw.miservice. execicationicationquery _
("SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY _ LOCAL_MACHINE 'AND "&_

"KeyPath = 'Software \ Microsoft \ Windows \ CurrentVersion \ run '")
Do
Set objLatestEvent = colEvents. NextEvent
Wscript. Echo Now & ": The registry has been modified ."

In fact, there are four types of Loop in WMI that can monitor the registry:

• RegistryEvent
• RegistryTreeChangeEvent
• RegistryKeyChangeEvent
• RegistryValueChangeEvent

You can see what the class name is. The above Code uses RegistryKeyChangeEvent, that is, the registry key change event.

Here, I don't want to talk about the usage of WMI events. This is a basic thing. I also don't want To Translate Reference documents. If I can't even understand this simple English, I don't need to use WMI. In my opinion, the most difficult part of WMI is that there are too many classes in it, and I often don't know which class to use to implement the desired function. Now, it is clear which class should be used, and this article can be completed.

Reference link:Registering for System Registry Events

Original article: http://demon.tw/programming/vbs-wmi-monitor-changes-to-a-registry-key.html