Today we are going to show you how to use one of our favorite tools, Proc Mon, to see which registry keys are edited when you change a Group Policy setting on your PC.
Using Proc Mon to See Which Registry Settings a Group Policy Object Modifies
The first thing you will want to do is go and get yourself a copy of Proc Mon from the Sys Internals website.
Then you will need to extract the folder and run the Procmon.exe file.
When Proc Mon opens, you will need to add a condition as follows:
Process Name is mmc.exe then Include
Then click the add button.
To get only the registry keys that are changed, we need add another one:
Operation is RegSetValue then Include
Then again click the add button.
Once the two rules have been added, you can go ahead and click ok.
Now go and open the Group Policy setting that you wish to edit.
Before you actually change the setting, switch back over to Proc Mon and clear the log.
Then go and change the GPO and click apply.
If you switch over to Proc Mon you will see that you have a registry key(s) there. Right-click on it and select the Jump To… option from the context menu.
That will fire up Regedit and take you to the exact key which was modified
That’s all there is to it guys.
- › What Is “Group Policy” in Windows?
- › How to Get Pro Features in Windows Home Versions with Third Party Tools
- › How to Enable and Use Internet Explorer 11’s Enterprise Mode
- › GNOME 44 Is Here to Make Your Linux PC Better Than Ever
- › Microsoft Loop is The Ultimate Team Collab Tool
- › Special UPDF Offer, Plus Deals on Pixel Watch, PC Monitors, and More
- › 8 Common Discord Scams (and How to Protect Yourself)
- › Five Ways Smart Electric Toothbrushes Can Transform Your Oral Health