I clicked the Add button to add the new condition to the filter. I was only interested in the entries that wrote to the registry, so I added a filter for “operations is RegSetValue”. I needed to filter this down to the events that wrote to the registry.

Those few minutes of capturing data logged 21,323 registry events. First, I turned on the capture, Ctrl+E, switched to settings and made my change, the back over to Promon to stop the capture, Ctrl +E. I then switched back and forth between settings and Promon. To minimize the amount of data returned, I opened Settings and proceeded to the page with the setting I needed to capture. To start my capture with a clean slate, I stopped the current capture, Ctrl+E, then cleared the display, Ctrl+X. Given that I was only interested in finding registry values, I filtered the view to the registry by de-selecting the icons for file activity, network activity, process and thread activity, and finally profiling events. I opened the application running it as Administrator with elevated privileges. Then because I had downloaded from the Internet, I opened the file properties and unblocked the file so I could run it. First, I downloaded the newest version of the utility from. To configure the task sequence, I needed to know the registry keys values that were set were when disabling options in Windows 10 Settings. We did not want to use GPO settings because the users needed the ability to change the values. I was working on a new Windows 10 deployment where specific settings needed to be disabled. However, it was not until this week I opened the book and used the Promon tool. I even purchased the book “Troubleshooting with the Windows Sysinternals Tools”. At Ignite 2017 I attended the Sysinternals sessions and thought that is great, these tools could help me. This is because I have never taken the time to use and understand the tool. I am ashamed to say I have always found the Procmon tool by Sysinternals intimidating to use.

Process monitor registry changes