Find what is changing the registry value

Boopathi Subramaniam 3,241 Reputation points
2023-05-11T15:08:32.0033333+00:00

Hello,

I am changing the Data for the value AutoConfigURL under

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Once I changed and Refresh the registry it come backs to previous value.

I tried to use ProessMonitor to find what is change it? But i do not get the information in Process Monitor.

I deleted AutoConfigURL and Refresh the registry, then AutoConfigURL is created.

Please let me know how to find how this value is changing itself

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,988 questions
0 comments No comments
{count} votes

Accepted answer
  1. Daisy Zhou 20,461 Reputation points Microsoft Vendor
    2023-05-18T01:54:18.8833333+00:00

    Hello Boopathi Subramaniam,

    Thank you for posting in our Q&A forum.

    You can try to enable audit policy via local group policy and audit permissions on this specific registry key.

    Tip: This event generates when a registry key value was modified. It doesn’t generate when a registry key was modified.

    Here are the detailed steps:

    For enabling audit policy via local group policy:

    Legacy audit policy:

    Computer Configuration\Windows settings\security settings\local policies\audit policy

    Audit object access– Success and Failure

    Or use advanced audit policies (advanced audit policies will overwrite all legacy audit policies by default):

    Computer Configuration\Windows settings\security settings\Advanced Audit Policy Configuration\Audit object access\Audit Registry– Success and Failure

    For setting audit permissions on this specific registry key:
    1.Find this specific registry key and set as below.
    per1

    1. Set Auditing entry for control.
      Principal: Everyone.
      Type: All
      Applies to: This key and subkeys.
      Full control for Basic permission and advanced permissions.
      per2

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657

    Hope the information above is helpful. If you have any question or concern, please feel free to let us know.

    Best Regards,
    Daisy Zhou

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments No comments

0 additional answers

Sort by: Most helpful