Asked by:
Powershell detect change to the registry

Question
-
Hi
I’m looking for a command line method to detect a change to the registry and if detected notify the user
I’m looking for the script to do this by itself without needing to manually set audit policies using the windows GUI
The idea I’ve come up with is to watch for event id 4657 to to occur in the registry
After researching online i am using
Auditpol /set /subcategory:@Registry@ /success:enable # To set the audit policy to ON for the registry
Get-Winevent -Computername $env:ComputerName -FilterHasTable @{logname=’security’id=4657} # To display the event 4657
I’ve noticed that no event 4657 has been generated when I manually filter the registry security logs after a few days
Is there a way using powershell to force this to on ? Or is there an easy way to detect if any registry key has been changed ?
I’ve looked at exporting the reg to a file repeating then comparing the reg files but looking for an alternative
Thanks
confuseis
- Moved by Bill_Stewart Thursday, March 14, 2019 8:40 PM This is not "scripts on demand"
Saturday, November 17, 2018 4:09 PM
All replies
-
You should be able to do this with PowerShell DSC.Saturday, November 17, 2018 4:57 PM
-
To audit registry changes you have to assign the policies in the registry SACL.
For instructions see: https://blogs.msdn.microsoft.com/cobold/2011/11/29/monitoring-when-registry-keys-are-modified/
You must be very careful when auditing anything for changes as this can cause a huge amount of traffic. Be sure to target a specific key or a few keys. Some keys are altered constantly by the system so think about what you are trying to audit.
\_(ツ)_/
- Edited by jrv Saturday, November 17, 2018 5:02 PM
Saturday, November 17, 2018 5:01 PM -
Here is a better link for this: https://helpcenter.netwrix.com/Configure_IT_Infrastructure/Windows_Server/WS_Registry.html#2012
\_(ツ)_/
Saturday, November 17, 2018 5:14 PM -
Thanks. Ill have a look.
Yes I was looking top monitor a specific event 4657. Basically any change to the registry
confuseis
Saturday, November 17, 2018 7:40 PM