{"id":2149,"date":"2016-03-17T11:45:16","date_gmt":"2016-03-17T06:15:16","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=2149"},"modified":"2019-05-12T02:55:39","modified_gmt":"2019-05-12T02:55:39","slug":"process-monitor-track-access-denied-registry-file-events","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/process-monitor-track-access-denied-registry-file-events\/","title":{"rendered":"How to Track “Access Denied” Registry and File Events Using Process Monitor"},"content":{"rendered":"

A well-written application does proper error handling, notifying the user in detail about the error it countered and how to go about fixing it, rather than failing silently or throwing up an obscure error code and quitting. This post tells you how to trace "Access Denied" events for file and registry activities occurring in the system, using Process Monitor.<\/p>\n

(I already have a how-to article on using Process Monitor<\/a> with example; and this article specifically explains how to track\/trace "Access Denied" entries by configuring the Filtering Options in Process Monitor.)<\/p>\n

1. Get Process Monitor<\/a> from Windows SysInternals page<\/a>.<\/p>\n

2. Accept the EULA that appears when you run the program for the first time.<\/p>\n

3. Process Monitor starts capturing events automatically. Stop capturing by clicking Capture button (CTRL + E) in the toolbar.<\/p>\n

<\/p>\n

The set of 5 buttons you see in the right is for displaying 5 different activities that are captured.<\/p>\n

(Everything is captured anyway, but you can choose what’s shown in the output window.)<\/p>\n

    \n
  1. \n

    Registry<\/li>\n

  2. \n

    File system<\/li>\n

  3. \n

    Network activity<\/li>\n

  4. \n

    Process and Thread activity<\/li>\n

  5. \n

    Process Profiling<\/li>\n<\/ol>\n

    4. Most basic troubleshooting procedure require buttons 1 or 2 (or both, if required) turned on. So, enable buttons 1 & 2 to start with.<\/p>\n

    5. From the Filter menu, and click Filter (CTRL + L)<\/p>\n

    <\/p>\n

    6. In the Process Monitor Filter dialog, click the Reset button. This is to clear any filters if you’ve configured earlier.<\/p>\n

    7. Then, set the filtering options as the one below, to catch specifically "Access Denied" entries.<\/p>\n

    \n
    Result contains DENIED<\/b> then Include<\/pre>\n<\/div>\n
    8. Click Add<\/b>, and click OK.<\/p>\n
    <\/p>\n
    9. Start capturing by enabling the Capture toggle button in the toolbar.<\/p>\n
    10. Now, start to reproduce the problem. Suppose you try to create a registry key and encounter an error.. try to do the same operation while Process Monitor is capturing it in the background.<\/p>\n
    11. After reproducing the problem, you’ll see Process Monitor list the Access Denied entries (if it has occurred any.)<\/p>\n
    <\/p>\n
    In this example, I tried to create a registry key under the HKEY_CLASSES_ROOT branch using the REG.EXE command-line, and it countered an Access Denied error. Of course, I knew REG.EXE needs to be run under elevated Command Prompt to create or modify keys in the system areas of the registry. This is for the purpose of illustration.<\/i><\/p>\n
    12. Make a note of the Process name, operation it tried to perform and the file\/directory or the registry Path it tried to modify. Alter permissions if necessary.<\/p>\n
    However, note that not all ACCESS DENIED entries you see in Process Monitor may necessarily be problematic events. Some are perfectly normal. If you’re not sure what’s shown in the log, save the log to a PML file. compress it and send to the respective support team.<\/p>\n","protected":false},"excerpt":{"rendered":"
    A well-written application does proper error handling, notifying the user in detail about the error it countered and how to go about fixing it, rather than failing silently or throwing up an obscure error code and quitting. This post tells you how to trace "Access Denied" events for file and registry activities occurring in the … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[7],"tags":[414],"class_list":["post-2149","post","type-post","status-publish","format-standard","hentry","category-windows","tag-process-monitor"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":988,"url":"https:\/\/www.winhelponline.com\/blog\/process-monitor-track-events-generate-log-file\/","url_meta":{"origin":2149,"position":0},"title":"Using Process Monitor to Track Registry and File System Changes","author":"Ramesh","date":"February 1, 2009","format":false,"excerpt":"Process Monitor is an excellent troubleshooting tool from Windows Sysinternals that displays the files and registry keys that applications access in real-time. The results can be saved to a log file, which you can send to an expert for analyzing a problem and troubleshooting it. This article tells you how\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"ProcMon PML log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/02\/procmon-save-log.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":19471,"url":"https:\/\/www.winhelponline.com\/blog\/cannot-import-reg-not-all-data-was-successfully\/","url_meta":{"origin":2149,"position":1},"title":"Cannot import .REG file; Not all data was successfully written to registry","author":"Ramesh","date":"October 22, 2020","format":false,"excerpt":"Sometimes, when applying the registry settings using a .reg file, you may get one of the following errors: Cannot import file.reg: Not all data was successfully written to the registry. Some keys are open by the system or other processes, or you have insufficient privileges to perform this operation. Cannot\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"cannot import .reg file - error accessing registry","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/reg-file-import-error-4.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":76091,"url":"https:\/\/www.winhelponline.com\/blog\/boot-trace-process-monitor\/","url_meta":{"origin":2149,"position":2},"title":"How to Run a Boot Trace Using Process Monitor","author":"Ramesh","date":"July 25, 2024","format":false,"excerpt":"Process Monitor is an excellent diagnostic tool from Microsoft Sysinternals. It can run a trace during the current Windows session or trace the boot process. Let's see how to enable boot tracing using Process Monitor. Enable Boot Logging using Process Monitor Download Process Monitor and run it. Read and accept\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"Process monitor boot logging","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/procmon-boot-log-9.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/procmon-boot-log-9.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/procmon-boot-log-9.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/procmon-boot-log-9.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":19688,"url":"https:\/\/www.winhelponline.com\/blog\/compressed-zip-folder-error-file-not-found-no-read-permission\/","url_meta":{"origin":2149,"position":3},"title":"Compressed (Zipped) Folder Error “File not found or no read permission”","author":"Ramesh","date":"November 4, 2020","format":false,"excerpt":"When you try to create a compressed (zipped) folder in Windows 10, the following error occurs: Compressed (zipped) Folders Error File not found or no read permission. You may have noticed that this error doesn't happen on drives formatted as FAT32.\u00a0This article explains why this problem occurs and how to\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"compressed folder create error - no read permissions - process explorer","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":5637,"url":"https:\/\/www.winhelponline.com\/blog\/process-monitor-unable-to-write-procmon23-boot-logging\/","url_meta":{"origin":2149,"position":4},"title":"Process Monitor “Unable to write PROCMON23.SYS” Enabling Boot Logging","author":"Ramesh","date":"October 25, 2017","format":false,"excerpt":"Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process\/thread activity. It can also trace the entire boot process and save to a PML log file. When enabling the setting \"Enable Boot Logging\" from the Options menu in Process Monitor, the following error\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/procmon-boot-logging-error.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":3346,"url":"https:\/\/www.winhelponline.com\/blog\/procmon-track-process-creation-exit-time\/","url_meta":{"origin":2149,"position":5},"title":"Track Process Creation and Exit Time Using Process Monitor","author":"Ramesh","date":"June 21, 2016","format":false,"excerpt":"Summary: This post tells you how to track process creation and exit events using the Process Monitor utility. My previous post, List Running Processes, helps you track down currently running processes. And the article Command Prompt Opens and Closes immediately\u00a0tells you if a last run program window was a scheduled\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"process creation and exit time","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/2149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=2149"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/2149\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=2149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=2149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=2149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}