Jump to content


Photo

Monitor:Registry State


  • Please log in to reply
1 reply to this topic

#1 ChrisN

ChrisN

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 06 February 2014 - 07:27 AM

Hello,

 

I would like to see if I can get the Registry State monitor to track a reg key for me

What I'm trying to do is monitor the string value of "AutoAdminLogon".  The default value is zero but if you set the system up to auto log in a account you will need to change that value to one.  

 

Here is the location. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon

 

I've set the probe to the following

 

key:HKEY_LOCAL_MACHINE,  

Subkey:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

Field:AutoAdminLogon

Enter data to find here:1

 

When I set the probe in this fashion I get an error result of "Field doesn't exist.

 

I just wanted to see if the probe can drill in on that string value for me. 

 

Thanks for your time. 

 

Chris

 

 

 

 

Attached Thumbnails

  • Screenshot - 2_6_2014 , 10_22_26 AM.jpg


#2 Zak

Zak

    Administrator

  • Root Admin
  • PipPipPip
  • 747 posts
  • Gender:Male

Posted 06 February 2014 - 08:03 AM

Hello Chris,

 

Unfortunately TNM does not support reading from the 64-bit part of the registry, i.e. on 64-bit systems it can only see values from HKEY_LOCAL_MACHINE\SOFTWARE that are located in Wow6432Node (when you look at it with the 64-bit regedit.exe).


Softinventive Lab support




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users