How to Use Process Monitor to Track Registry and File System Changes


Process Monitor is an excellent troubleshooting tool from Windows Sysinternals that displays the files and registry keys that applications access in real-time. The results can be saved to a log file, which you can send it to an expert for analyzing a problem and troubleshooting it.

Here is a guide on how to capture registry and file system accesses by applications, and generate a log file using Process Monitor for further analysis.

Use Process Monitor to Track Registry and File System Changes

Scenario: Let’s assume you’re unable to write to the HOSTS file successfully in Windows, and want to know what’s happening under the hood. Every step in the following article revolves around this sample scenario.

Step 1: Running Process Monitor & Configuring Filters

  1. Download Process Monitor from Windows Sysinternals site.
  2. Extract the zip file contents to a folder of your choice.
  3. Run the Process Monitor application
  4. Include the processes that you want to track the activity on. For this example, you want to include Notepad.exe in the (Include) Filters.
  5. Click Add, and click OK.

    Tip: You can add multiple entries as well, in case if you want to track few more processes along with Notepad.exe. To keep this example simpler, let’s only track Notepad.exe.

    (You’ll now see the Process Monitor main window tracking the list of registry and file accesses by processes real-time, as and whey they occur.)

  6. From the Options menu, click Select Columns.
  7. Under “Event Details”, enable Sequence Number, and click OK.

Step 2: Capturing Events

  1. Open Notepad.
  2. Switch to Process Monitor window.
  3. Enable the “Capture” mode (if it’s not already ON). You can see the status of the “Capture” mode via the Process Monitor toolbar.
    The highlighted button above is the “Capture” button, which is current disabled. You need to click that button (or use Ctrl + E key sequence) to enable capturing of events.
  4. Cleanup the existing events list using Ctrl + X key sequence (Important) and start afresh
  5. Now switch to Notepad and try to reproduce the problem.

    To reproduce the problem (for this example), try writing to HOSTS file (C:\Windows\System32\Drivers\Etc\HOSTS) and saving it. Windows offers to save the file (by showing the Save As dialog) with a different name, or in a different location.

    So, what happens under the hood when you save to HOSTS file? Process Monitor shows that exactly.

  6. Switch to Process Monitor window, and turn off Capturing (Ctrl + E) as soon as you reproduce the problem.
    Important Note: Don’t take much time to reproduce the problem after enabling capturing. Similarly turn off capturing as soon as you finish reproducing the problem. This is to prevent Process Monitor from recording other unneeded data (which makes analysis part more difficult). You need to do all that as quickly as you can.

    Solution: The log file above tells us that Notepad encountered an ACCESS DENIED error when writing to the HOSTS file. The solution would be to simply run Notepad elevated (right-click and choose “Run as Administrator”) to be able to write to HOSTS file successfully.

Step 3: Saving the Output

  1. In the Process Monitor window, select the File menu and click Save
  2. Select Native Process Monitor Format (PML), mention the output file name and Path, save the file.
  3. Right-click on the Logfile.PML file, click Send To, and choose Compressed (zipped) folder. This compresses the file by ~90%. Look at the graphic below. You certainly want to zip the log file before sending it to someone.

Editor’s note: I usually suggest my clients to save the log with the All events option so that I can get wide options for troubleshooting the subject computer effectively. If you’re going to send me a Process Monitor log, make sure you enable the All Events option when saving the log file. Also, don’t forget the compress (.zip) the log file before sending.

That’s it, readers. To keep the documentation simple, I’ve used the easiest example so that an end-user understands clearly how to efficiently track registry and file system events using Process Monitor & generate the log file.


About the author

Ramesh Srinivasan founded back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.

3 thoughts on “How to Use Process Monitor to Track Registry and File System Changes”

  1. Thanks for this – it was refreshingly well-written and was useful for me.
    Sites like this, written by someone who is able to communicate well are
    getting very scarce !

Leave a Comment