Monitoring Subkey-Level Events

Microsoft® Windows® 2000 Scripting Guide

« Previous | Next »   

You might want to monitor an entire subkey if you are interested in changes happening to a group of related registry entries. For instance, if you are troubleshooting an application that does not seem to save user customization data and you know the data should be stored in the registry, you can monitor the registry subkey of the program where the configuration settings are stored, in an effort to understand what is going wrong.

To monitor a subkey, subscribe to the RegistryKeyChangeEvent, specifying the subtree where the subkey you are interested in monitoring is located as well as the path of the subkey you want to monitor. Like the RegistryTreeChangeEvent, the RegistryKeyChangeEvent is fired when a modification is made to the subkey being monitored and the event does not provide any information beyond the fact that a modification has taken place.

Scripting Steps

The script in Listing 16.18 monitors and reports on events in the subkey. To carry out this task, the script must perform the following steps:

1. Use the GetObject method to connect to the WMI service.
2. Use the CreateObject method to create an event sink.
3. Use ExecNotificationQuery to register for the event.
4. Put the script in sleep mode while waiting on the event.
5. Implement the event handler as a subroutine that uses the Echo method to display a message indicating that a registry change event was received.

Listing 16.18   Monitoring Events at the Subkey Level

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 

strComputer = "." Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _      strComputer & "\root\default")  Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")  wmiServices.ExecNotificationQueryAsync wmiSink, _     "SELECT * FROM RegistryKeyChangeEvent WHERE Hive= " _         & "'HKEY_LOCAL_MACHINE' AND "  _                 & "KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'"  Wscript.Echo "Listening for Registry Change Events ..." & vbCrLf  Do While(1)      Wscript.Sleep 1000  Loop  Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)      Wscript.Echo "Received Registry Change Event" & vbCrLf & _          "------------------------------" & vbCrLf & _              wmiObject.GetObjectText_()  End Sub 

---

 Send us your feedback

« Previous | Next »