RegistryKeyChangeEvent class
The RegistryKeyChangeEvent class represents changes to a specific key. The changes apply only to the key, not its subkeys. For more information about using the WMI registry event classes, see the Modifying the System Registry section. For code examples, see WMI Tasks: Registry.
The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties and methods are in alphabetic order, not MOF order.
Syntax
class RegistryKeyChangeEvent : RegistryEvent
{
string Hive;
string KeyPath;
};
Members
The RegistryKeyChangeEvent class has these types of members:
Properties
The RegistryKeyChangeEvent class has these properties.
-
Hive
-
-
Data type: string
-
Access type: Read-only
Name of the hive (subtree) that contains the key (or keys) that is changed. For example, HKEY_LOCAL_MACHINE. Changes to the HKEY_CLASSES_ROOT and HKEY_CURRENT_USER hives are not supported by RegistryEvent or classes derived from it, such as RegistryKeyChangeEvent.
-
-
KeyPath
-
-
Data type: string
-
Access type: Read-only
Path to the registry key. For example, "SOFTWARE\Microsoft\WBEM\Scripting".
-
Remarks
Queries that provide a KeyPath must have backslashes escaped. For example,
wmiServices.ExecNotificationQuery("SELECT * FROM RegistryKeyChangeEvent "_
& "WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft'")
Registry provider classes, unlike most of the Win32 classes are located in the WMI "Root\Default" namespace.
Examples
The following VBScript code example calls the asynchronous method SWbemServices.ExecNotificationQueryAsync to monitor changes in any values under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting. Note that the backslashes in the registry key are escaped by a backslash ("\"). For more information about asynchronous calls and security, see Making an Asynchronous Call with VBScript.
To see the operation of this script, execute the script and use a registry editor such as Regedit to change the Default Namespace value under this key. Be sure to change it back to the original value.
The following script runs until the computer is restarted, WMI is stopped, or the script is stopped. To stop the script manually, use Task Manager to stop the process. To stop it programmatically, use the Terminate method in the Win32_Process class.
Set wmiServices = GetObject("winmgmts:root/default")
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
wmiServices.ExecNotificationQueryAsync wmiSink, "SELECT * FROM RegistryKeyChangeEvent " _
& "WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\WBEM\\Scripting'"
WScript.Echo "Listening for Registry Key Change Events..." & vbCrLf
While(True)
WScript.Sleep 1000
Wend
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
WScript.Echo "Received Registry Change Event" & vbCrLf & wmiObject.GetObjectText_()
End Sub
Requirements
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
Root\default |
| MOF |
|
| DLL |
|