How to Audit Registry Key Changes in Windows

Auditing Windows Registry modifications allows administrators to monitor critical system configurations and track unauthorized changes made by users. This guide explains how to enable registry auditing through the Local Security Policy, configure specific key permissions in the Registry Editor (Regedit), and analyze the generated log entries in the Windows Event Viewer.

Step 1: Enable Object Access Auditing in Local Security Policy

Before tracking changes to individual registry keys, you must enable object auditing at the system level.

  1. Press Win + R, type secpol.msc, and press Enter to open the Local Security Policy console.
  2. In the left pane, navigate to Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Object Access. (Alternatively, under older configurations, navigate to Local Policies > Audit Policy).
  3. Double-click on Audit Registry.
  4. Check both Success and Failure to log all attempted modifications.
  5. Click Apply and then OK.

Step 2: Configure Auditing on Target Registry Keys in Regedit

Once global auditing is enabled, specify which registry keys to monitor.

  1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
  2. Navigate to the registry key you want to monitor (e.g., HKEY_LOCAL_MACHINE\Software\Policies).
  3. Right-click the key and select Permissions….
  4. In the permissions window, click the Advanced button.
  5. Switch to the Auditing tab and click Add.
  6. Click Select a principal, type Everyone (or a specific user/group), and click OK.
  7. Set the Type to All (or Success / Fail depending on your needs).
  8. Under Applies to, select This key and subkeys.
  9. Click Show advanced permissions and select the actions you wish to audit, such as:
    • Set Value
    • Create Subkey
    • Delete
    • Write DAC (permission changes)
  10. Click OK, then Apply, and close all property windows.

Step 3: Monitor Registry Changes in Event Viewer

All audited actions on the configured registry keys will now be recorded in the Windows Security Log.

  1. Press Win + R, type eventvwr.msc, and press Enter.
  2. Expand Windows Logs and click on Security.
  3. Look for the following Event IDs in the log list:
    • Event ID 4657: A registry value was modified (includes old value, new value, process name, and user account).
    • Event ID 4663: An attempt was made to access an object.
    • Event ID 4656: A handle to an object was requested.
  4. Click on an event to view detailed information regarding the user, process, and exact registry data changed.