Why do I get notified for changes to HKEY_CLASSES_ROOT when nobody is writing to HKEY_CLASSES_ROOT?
A customer had a question about the
We are using it to monitor the
HKEY_CLASSES_ROOTtree as follows:RegNotifyChangeKeyValue( HKEY_CLASSES_ROOT, true, // monitor entire subtree REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, eventRegKeyChanged, true); // asynchronous mode
If I understand the documentation correctly,
this registers for notifications when subkeys are added,
deleted, or when values are changed.
However, it seems that my event becomes signaled at many
for example, when I switch folders in an Explorer window.
I fired up Process Monitor and confirmed that nobody (not even
Explorer) is writing to
Why are we getting spurious notifications?
Have we misunderstood what this function does?
Everything is working as expected;
it’s just that your expectations are wrong.
Recall that the
HKEY_CLASSES_ROOT registry key
is really a
combined view of
Specifically, it is a combined view of
is itself just an alias for
Therefore, if you’re going to look in
you need to be looking at all of those locations to see changes
that eventually get reported as changes in
In this particular case, Explorer was making changes to
which shows up as
Upon receiving this explanation, the customer understood what
was going on, and also remarked that they were going to look to
see if they could register their notification on a location that
isn’t quite so broad.