Home Search Contact us About us
Title Registry Events.
Summary Reading the registry repeatedly to detect changes can be slow and gobble up resources. A better solution is to create an event when a change occurs and monitor that event.
Contributor John McTainsh
Published 12-Oct-2000
Last updated 12-Oct-2000
Page rating   93% for 3 votes Useless Brilliant


The basic idea is to create an event that is attached to a registry key. When the key changes the event is triggered. It is then a simple task to poll the event to see if it has signalled and act upon this value.

How to do it.

Open the registry key and attach an event to it.
    // Open a key.
    TCHAR szSubKey[] = _T("Software\\Microsoft\\Clock");
    HKEY   hKey;          // Key to the registery item to watch
    LONG   lErrorCode;    // Error code catcher
    lErrorCode = RegOpenKeyEx(HKEY_CURRENT_USER, 
                              szSubKey, 0, KEY_NOTIFY, &hKey);
    if( lErrorCode != ERROR_SUCCESS )
        TRACE( _T("Error in RegOpenKeyEx.\n") );
        return false;
    // Create an event.
    HANDLE hEvent;        // Event output for change
    hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
    if( hEvent == NULL )
        TRACE( _T("Error in CreateEvent.\n") );
        return false;

    // Watch the registry key for a change of value.
                      REG_NOTIFY_CHANGE_ATTRIBUTES |
                      REG_NOTIFY_CHANGE_LAST_SET |

    lErrorCode = RegNotifyChangeKeyValue(
        hKey,            // handle to key to watch
        TRUE,            // subkey notification option
        dwFilter,        // changes to be reported
        hEvent,          // handle to event to be signaled
        TRUE);           // asynchronous reporting option

    if( lErrorCode != ERROR_SUCCESS )
        TRACE( _T("Error in RegNotifyChangeKeyValue.\n") );
        return false;
Where you want to check it the registry item has changed use.
    // Check if the event has occured.
    switch( WaitForSingleObject( hEvent, 0 ) )
    // Reg item has changed
    case WAIT_OBJECT_0:
    // Reg item has NOT changed
    case WAIT_TIMEOUT:
    // This an error condition that should not happen
    // if it does we best reopen the event and key.
        TRACE( _T("Error in WaitForSingleObject.\n") );
Before you go home clean up the mess.
    // Close the key.
    lErrorCode = RegCloseKey(hKey);
    if( lErrorCode != ERROR_SUCCESS )
        TRACE( _T("Error in RegCloseKey.\n") );
    // Close the handle.
    if( !CloseHandle( hEvent ) )
        TRACE( _T("Error in CloseHandle.\n") );
Comments Date
thnx 22-Oct-2008 mithun
I always wanted to build `professionaloid` softwares. That is to monitor Windows registry, virus scanners and so on. Thanks to mctainsh.com for giving this invaluable site to eager students like me!

thnx 1`s agIn!
Home Search Contact us About us