The first column represents the time the action took place with the precision of a tenth of a microsecond. Note that the time displayed here may be slightly different from the moment the activity occurred. Registrar ensures that each operation displays a unique time-stamp so that columns in the view can be restored in their original order.
The second column tells you the type of operation that took place. These actions correspond to Windows kernel service names.
The third column displays the name of executable process that requested the activity.
The fourth column displays whether the action was successful or generated an error.
The fifth column reflects the name of the registry key that was affected.

The column after that shows the name of the value that was affected by the activity. If no registry value was involved, this column remains blank.

The seventh column displays registry data that may have been processed with the operation, the column after that shows the registry value type and size in the case the registry activity involved a successful operation on a registry value.
The value type column displays the name of the registry value type in the case the item is a registry value. The size column displays the size of the registry value
The HKEY column shows the handle of the registry key
PID column shows the process ID of the process involved in the action
ThreadID shows the ID of the thread that performed the action.
CPU displays the processor number which initiated the action.

Advanced Options

Several options exist which allow you to control the behavior of the monitor. In the Advanced Options Dialog you will find several options that allow you to control the behavior of the registry monitor and filter unwanted operations.

Online Help Topics

Introduction

· Introduction