今天我們將向您展示如何使用我們最喜歡的工具之一Proc Mon，在您更改PC上的組策略設置時查看編輯的註冊表項。

使用Proc Mon查看組策略對象修改的註冊表設置

您要做的第一件事就是從Sys Internals網站獲取Proc Mon的副本。

然後，您需要解壓縮該文件夾並運行Procmon.exe文件。

當Proc Mon打開時，您需要添加如下條件：

進程名稱是mmc.exe然後包含

然後單擊"添加"按鈕。

要僅獲取更改的註冊表項，我們需要添加另一個：

操作是RegSetValue然後包括

然後再次單擊"添加"按鈕。

添加完兩個規則後，您可以繼續並單擊

現在轉到打開要編輯的組策略設置。

在實際更改設置之前，請切換回Proc Mon並清除日誌。

然後轉到並更改GPO並單擊"應用"。

如果切換到Proc Mon，您將看到您有一個註冊表項。右鍵單擊它，然後從上下文菜單中選擇Jump To ...選項。

這將啟動Regedit並帶您到修改後的確切密鑰

這就是它們的全部。

How to See Which Registry Settings a Group Policy Object Modifies

Today we are going to show you how to use one of our favorite tools, Proc Mon, to see which registry keys are edited when you change a Group Policy setting on your PC.

Using Proc Mon to See Which Registry Settings a Group Policy Object Modifies

The first thing you will want to do is go and get yourself a copy of Proc Mon from the Sys Internals website.

Then you will need to extract the folder and run the Procmon.exe file.

When Proc Mon opens, you will need to add a condition as follows:

Process Name is mmc.exe then Include

Then click the add button.

To get only the registry keys that are changed, we need add another one:

Operation is RegSetValue then Include

Then again click the add button.

Once the two rules have been added, you can go ahead and click ok.

Now go and open the Group Policy setting that you wish to edit.

Before you actually change the setting, switch back over to Proc Mon and clear the log.

Then go and change the GPO and click apply.

If you switch over to Proc Mon you will see that you have a registry key(s) there. Right-click on it and select the Jump To… option from the context menu.

That will fire up Regedit and take you to the exact key which was modified

That‘s all there is to it guys.

[No000017F]如何監控註冊表的修改