The "ELM 411" - Monitoring Windows Registry Keys
The Windows Registry can arguably be referred to as the Central Nervous System for a computer. Stored here is information and settings for all the hardware, operating system software, most non-operating system software, and each user account settings. The registry also provides a window into the operation of the kernel, exposing runtime information such as performance counters and currently active hardware. Careless editing of the registry can cause irreversible damage in some cases which leads us into this month's ELM 411 Topic - using ELM to monitor Windows Registry Keys. This steps covered in this article are somewhat involved and therefore not recommended for the faint of heart.
The WMI (Windows Management Instrumentation) Monitor, found in both ELM Enterprise Manager and ELM Performance Manager provides the ability to monitor changes in a registry value. First however, you must create something called a MOF file on each machine you plan to monitor the registry on to "publish the key" so that WMI can read from it.
For this first step in the example, we'll use the registry keys that ELM creates. Our sample MOF file looks like this:
#pragma namespace("\\\\.\\root\\default")
#pragma deleteclass("TNTRegKey", NOFAIL)
[DYNPROPS]
class TNTRegKey
{
[key]string Keyname="";
string ELGenCount;
string ELGenString;
};
[DYNPROPS]
instance of TNTRegKey
{
KeyName="ELGenCnt";
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\TNT Software\\ELM Enterprise Manager\\5.5\\Settings|ELGen GenCount"),
Dynamic, Provider("RegPropProv")] ELGenCount;
[PropertyContext("local|HKEY_LOCAL_MACHINE\\Software\\TNT Software\\ELM Enterprise Manager\\5.5\\Settings|ELGen InsertionString"),
Dynamic, Provider("RegPropProv")] ELGenString;
};
The sample entries above can be edited in a simple application like Notepad and then saved as something like "myfile.mof".
There are a few things to be aware of here:
- First, the registry paths all have double slashes. This is absolutely necessary
- Second, the last thing in the path is the name of the actual registry value ELM is monitoring for changes. It is preceded by a pipe ( | ), not by slashes.
- Third, the class name can be whatever you would like, you get to define it (in our example we used "TNTRegKey")
- Likewise, the KeyName field is user defined as well. In our example it is called "ELGenCnt" This can be named anything you deem appropriate - it is not related to what you are monitoring.
- Finally we have the "ELGenCount" and "ELGenString". You can create whatever name you deem appropriate for these values as well. We used abbreviated forms of the actual value name to make more sense in the example and ours is publishing two values in the same key. If you only need to check one value, then only use one [PropertyContext... entry.
Once the script has been modified so that it is structured the way you want, you will have to compile it. A simple way to do this is to open a DOS window to the folder where you've saved the "myfile.mof" file and run this command:
mofcomp myfile.mof
If you get an error it will tell you what line number it is on. If you have everything setup right, it will give you a friendly little message saying that the file was parsed, stored and Done!
Now you can build the WMI Monitor Item in ELM to make use of this. The important thing here is to change the namespace to "root\default" (No quotations). root\cimv2 will not work for registry keys. For the instance above, our query looks like this:

Looking back over the script you can see which pieces get plugged in to that query.
Next in the WMI Monitor Item wizard, select the Agent Category/ies that will be monitored. The default monitoring interval is 60 seconds, however this can be adjusted to less often to reduce server overhead if necessary. Make sure to name the Monitoring Item appropriately when completing the wizard.
The first time the WMI Monitor runs it will write a Warning as it detects that the query results have changed from nonexistent to some value. From that point forward it will write a Warning whenever a value changes.
You are now monitoring for specific changes to the Windows Registry! We hope that you found this article informative and wish you continued success with your ELM deployment!
NOTE: All ELM 411 articles are written based on ELM Version 5.5 and instructions may not be accurate for previous ELM Versions. If you would like assistance upgrading to ELM 5.5 so you can use these tips - please contact support@tntsoftware.com.
Share your own ELM tips!
Have a tip or trick with our ELM products you'd like to share with our newsletter subscribers? Send your ideas and any applicable screen shots to info@tntsoftware.com with "ELM 411" in the subject line. We'll take a look and if usable you'll see it published here in the ELM 411 section of upcoming newsletters!