Re: Granting access to HKLM/Software/<application>



Okay, that's one of the two questions. <G>

How 'bout what types of entries I'm looking for that would signify an
attempt to access the remote registry?



"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:eBNqguH6GHA.3732@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

Under Options you can find a Filter where you enter only name of your
application (e.g. application.exe) instead of *. Now Regmon will only show
registry access done by application.exe

You have to run regmon on a computer where application will be run.

--
Mike
Microsoft MVP - Windows Security


"MyndPhlyp" <nobody@xxxxxxxxxxxxx> wrote in message
news:%23%23ds5UG6GHA.4112@xxxxxxxxxxxxxxxxxxxxxxx
Hmm. Lots of Registry chatter.

Run it from the workstation or the server?

How do I determine when the workstation is attempting to access the
server's
key? (RTFM didn't help.)



"Miha Pihler [MVP]" <mihap-news@xxxxxxxxxxx> wrote in message
news:%23OcuU%23F6GHA.3572@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

You can download the tool called RegMon from www.sysinternals.com.

Once you have it running on your computer - run the application and it
will
show you what registries are getting called and if there are any access
denied on these registries... This should help you troubleshoot the
problem...






.