How to Audit Registry Key Changes with Regedit

Auditing registry key modifications in Windows allows administrators to track changes, identify unauthorized tampering, and maintain system integrity. This guide explains how to enable registry auditing at the operating system level, apply granular audit settings to specific keys using the Registry Editor (regedit), and verify modification events within the Windows Event Viewer.

Step 1: Enable the Registry Audit Policy

Before Windows can record registry access attempts configured in regedit, the system-wide audit policy must be enabled.

  1. Press Win + R, type secpol.msc, and press Enter to open the Local Security Policy editor (or use gpmc.msc for domain environments).
  2. Navigate to Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Object Access.
  3. Double-click Audit Registry.
  4. Check both Success and Failure.
  5. Click Apply, then OK.

Step 2: Configure Audit Policies in Regedit

Once global auditing is enabled, define specific audit entries on the desired registry keys.

  1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
  2. Navigate to the registry key you want to monitor (e.g., HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run).
  3. Right-click the key and select Permissions.
  4. Click the Advanced button to open Advanced Security Settings.
  5. Switch to the Auditing tab. If prompted for administrator permissions, click Continue.
  6. Click Add to create a new audit entry.
  7. Click Select a principal, type Everyone (or a specific user/group), and click OK.
  8. Configure the entry:
    • Type: Select All, Success, or Fail.
    • Applies to: Choose This key and subkeys (or This key only).
  9. Click Show advanced permissions and select the specific actions to monitor:
    • Set Value: Logs modifications to existing values or newly created values.
    • Create Subkey: Logs when new subkeys are added.
    • Delete: Logs when values or subkeys are removed.
    • Write DAC: Logs attempts to change key permissions.
    • Write Owner: Logs attempts to change key ownership.
  10. Click OK, then Apply, and close all open dialog boxes.

Step 3: Monitor Registry Changes in Event Viewer

Windows records tracked actions to the security log.

  1. Press Win + R, type eventvwr.msc, and press Enter.
  2. Navigate to Windows Logs > Security.
  3. Filter the log for the following Event IDs:
    • Event ID 4657: A registry value was modified (includes process name, old value, and new value).
    • Event ID 4663: An attempt was made to access an object.
    • Event ID 4660: An object was deleted.
  4. Open the events to review the timestamp, the user account responsible, the process used to modify the key, and the specific data that changed.