Google "VBS Monitoring Registry", the top 5 are all the same code, I checked, the source is Hey, Scripting Guy! Blog on an article titled "How Can I Monitor Changes to a Registry Key?" How shameless.
I don’t have time to translate the article, so I’ll post the code:
You can tell what each class does by looking at the class name. The above code uses RegistryKeyChangeEvent, which is the registry key change event.
I don’t want to talk about the usage of WMI events here, which is very basic; I don’t want to translate the reference documents. If you can’t understand this simple English, there is no need to use WMI. I think the most difficult part of WMI is that there are too many classes in it, and many times I don’t know which class to use to achieve the desired function. Now, it is clear which class to use and this article can come to an end.
Reference link: Registering for System Registry Events
Original text: http://demon.tw/programming/vbs-wmi-monitor- changes-to-a-registry-key.html