{"id":5913,"date":"2012-12-05T07:00:00","date_gmt":"2012-12-05T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2012\/12\/05\/why-do-i-get-notified-for-changes-to-hkey_classes_root-when-nobody-is-writing-to-hkey_classes_root\/"},"modified":"2012-12-05T07:00:00","modified_gmt":"2012-12-05T07:00:00","slug":"why-do-i-get-notified-for-changes-to-hkey_classes_root-when-nobody-is-writing-to-hkey_classes_root","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20121205-00\/?p=5913","title":{"rendered":"Why do I get notified for changes to HKEY_CLASSES_ROOT when nobody is writing to HKEY_CLASSES_ROOT?"},"content":{"rendered":"<p>\nA customer had a question about the\n<code>Reg&shy;Notify&shy;Change&shy;Key&shy;Value<\/code> function.\n<\/p>\n<blockquote CLASS=\"q\">\n<p>\nWe are using it to monitor the\n<code>HKEY_CLASSES_ROOT<\/code> tree as follows:\n<\/p>\n<pre>\nRegNotifyChangeKeyValue(\n    HKEY_CLASSES_ROOT,\n    true, \/\/ monitor entire subtree\n    REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,\n    eventRegKeyChanged,\n    true); \/\/ asynchronous mode\n<\/pre>\n<p>\nIf I understand the documentation correctly,\nthis registers for notifications when subkeys are added,\ndeleted, or when values are changed.\nHowever, it seems that my event becomes signaled at many\nother times,\nfor example, when I switch folders in an Explorer window.\nI fired up Process Monitor and confirmed that nobody (not even\nExplorer) is writing to <code>HKEY_CLASSES_ROOT<\/code>.\n<\/p>\n<p>\nWhy are we getting spurious notifications?\nHave we misunderstood what this function does?\n<\/p>\n<\/blockquote>\n<p>\nEverything is working as expected;\nit&#8217;s just that your expectations are wrong.\n<\/p>\n<p>\nRecall that the\n<code>HKEY_CLASSES_ROOT<\/code> registry key\nis really a\n<a HREF=\"http:\/\/msdn.microsoft.com\/en-us\/library\/ms724475(v=VS.85).aspx\">\ncombined view of\n<code>HKEY_LOCAL_MACHINE<\/code> and\n<code>HKEY_CURRENT_USER<\/code><\/a>.\nSpecifically, it is a combined view of\n<code>HKEY_LOCAL_MACHINE\\Software\\Classes<\/code> and\n<code>HKEY_CURRENT_USER\\Software\\Classes<\/code>.\nAnd\n<code>HKEY_CURRENT_USER\\Software\\Classes<\/code>\nis itself just an alias for\n<code>HKEY_USERS\\&laquo;SID&raquo;_Classes<\/code>.\nTherefore, if you&#8217;re going to look in\nProcess Monitor,\nyou need to be looking at all of those locations to see changes\nthat eventually get reported as changes in\n<code>HKEY_CLASSES_ROOT<\/code>.\n<\/p>\n<p>\nIn this particular case, Explorer was making changes to\n<code>HKEY_USERS\\&laquo;SID&raquo;_Classes\\Local Settings<\/code>,\nwhich shows up as\n<code>HKEY_CLASSES_ROOT\\Local Settings<\/code>.\n<\/p>\n<p>\nUpon receiving this explanation, the customer understood what\nwas going on, and also remarked that they were going to look to\nsee if they could register their notification on a location that\nisn&#8217;t quite so broad.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A customer had a question about the Reg&shy;Notify&shy;Change&shy;Key&shy;Value function. We are using it to monitor the HKEY_CLASSES_ROOT tree as follows: RegNotifyChangeKeyValue( HKEY_CLASSES_ROOT, true, \/\/ monitor entire subtree REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, eventRegKeyChanged, true); \/\/ asynchronous mode If I understand the documentation correctly, this registers for notifications when subkeys are added, deleted, or when values are changed. [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-5913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>A customer had a question about the Reg&shy;Notify&shy;Change&shy;Key&shy;Value function. We are using it to monitor the HKEY_CLASSES_ROOT tree as follows: RegNotifyChangeKeyValue( HKEY_CLASSES_ROOT, true, \/\/ monitor entire subtree REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, eventRegKeyChanged, true); \/\/ asynchronous mode If I understand the documentation correctly, this registers for notifications when subkeys are added, deleted, or when values are changed. [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=5913"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=5913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=5913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=5913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}