RegistryTreeChangeEvent class
The RegistryTreeChangeEvent class represents changes to a key and its subkeys. For more information about using the WMI registry event classes, see the Modifying the System Registry section. For code examples, see the WMI Tasks: Registry topic.
The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties and methods are in alphabetic order, not MOF order.
Syntax
class RegistryTreeChangeEvent : RegistryEvent
{
string Hive;
string RootPath;
};
Members
The RegistryTreeChangeEvent class has these types of members:
Properties
The RegistryTreeChangeEvent class has these properties.
-
Hive
-
-
Data type: string
-
Access type: Read-only
Name of the hive that contains the key (or keys) that is changed. For example, HKEY_LOCAL_MACHINE. Changes to the HKEY_CLASSES_ROOT and HKEY_CURRENT_USER hives are not supported by RegistryEvent or classes derived from it, such as RegistryTreeChangeEvent.
-
-
RootPath
-
-
Data type: string
-
Access type: Read-only
Path to the registry key that contains the subkeys. For example, "SOFTWARE\Microsoft".
-
Remarks
Queries that provide a RootPath must have backslashes escaped. For example,
wmiServices.ExecNotificationQuery("SELECT * FROM RegistryTreeChangeEvent " _
& "WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath='SOFTWARE\\Microsoft'")
Registry provider classes, unlike most of the Win32 classes are located in the WMI root\default namespace.
Examples
The following example waits for changes in the HKEY_LOCAL_MACHINE hive using semisynchronous access. It runs until the Wscript.exe process is stopped in Task Manager. The 64-bit TIME_CREATED property is converted to a printable date by SWbemDateTime methods. For more information, see Calling a Method.
The following script runs until the computer is restarted, WMI is stopped, or the script is stopped. To stop the script manually, use Task Manager to stop the process. To stop it programmatically, use the Terminate method in the Win32_Process class.
wbemFlagReturnImmediately = 16
wbemFlagForwardOnly = 32
IFlags = wbemFlagReturnImmediately + wbemFlagForwardOnly
Set wmiServices = GetObject("winmgmts:root/default")
Set dtmCreateTime = CreateObject("WbemScripting.SWbemDateTime")
Set colRegChanges = wmiServices.ExecNotificationQuery _
("SELECT * FROM RegistryTreeChangeEvent " _
& "WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath='",, IFlags)
Do While (True)
Set TreeChange = colRegChanges.NextEvent
'Time_Created property is 64-bit and
' must be converted into CIM_DateTime format
dtmCreateTime.SetFileTime TreeChange.Time_Created, false
'Convert to VT_DATE format using GetVarDate
' for printing to screen
Wscript.Echo "Time = " & dtmCreateTime.GetVarDate() _
& VBNewLine _
& "Hive = " & TreeChange.Hive & VBNewLine _
& "RootPath = "& TreeChange.RootPath
Loop
Requirements
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
Root\default |
| MOF |
|
| DLL |
|