RegistryChangesView: monitor Windows Registry modifications
RegistryChangesView is a brand new portable application by Nirsoft for Windows that you may use to monitor the Registry for changes.
The program has been designed to take Registry snapshots, and compare these snapshots to list all changes that have been made to the keys and values included in both snapshots.
This can be very useful, for instance to find out which changes the installation of a program makes to the Registry, to monitor a particular key or value that you are interested in, or to reveal the Registry keys responsible for changes that you may in the Windows user interface.
Obviously, it is also possible to use the tool to revert changes, so that it works like a limited version of System Restore in this regard as well.
RegistryChangesView
The software program is portable, which means that you can run it from any location without installation.
It displays a configuration window on start. The very first thing you need to do on the first start of the program is to create a Registry snapshot.
This is a straightforward process, and results in a copy of the Registry being saved to the program folder.
You may create new snapshots whenever you want, and may compare any snapshot that you have created to the "current state" of the Registry, to another snapshot, or a shadow copy.
For comparison, you need to make sure the direction is correct, and that the hives that you want compared are selected.
As far as direction is concerned, you can compare the first data source with the second, or the other way round.
Most Registry hives are selected by default with the exception of SAM and Security. You may remove hives from the comparison; doing so may be beneficial, as it reduces the list of changes usually.
RegistryChangesView compares the two snapshots, and lists all keys that have changed in the main program window afterwards.
Each key is listed with its full path, change type, value name, type and value before and after the change (if available), and other information.
The application uses the typical Nirsoft layout; this means that you can sort the data with a click on a table column header, use the built-in search to find characters of interest, or export the data.
You may right-click on a selection to either open it in the Registry editor, or to save the data to a Registry file.
It is unfortunately not possible to run restore operations directly from RegistryChangesView. This means that you will have to open the Registry using it to restore values or types manually if you need to do that.
Similar programs to RegistryChangesView are What Changed, Registry Alert, or RegFromApp.
Verdict
RegistryChangesView is a powerful program to monitor the Registry for changes. If you want to use it to monitor changes, it is best to create the first snapshot before the changes are made to the system.
The program is easy to use, offers basic report generation and data saving options on top of that. An option to restore keys directly from the program would be useful, but is not supported.
