Why do I get notified for changes to HKEY_CLASSES_ROOT when nobody is writing to HKEY_CLASSES_ROOT?


A customer had a question about the Reg­Notify­Change­Key­Value function.

We are using it to monitor the HKEY_CLASSES_ROOT tree as follows:

RegNotifyChangeKeyValue(
    HKEY_CLASSES_ROOT,
    true, // monitor entire subtree
    REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
    eventRegKeyChanged,
    true); // asynchronous mode

If I understand the documentation correctly, this registers for notifications when subkeys are added, deleted, or when values are changed. However, it seems that my event becomes signaled at many other times, for example, when I switch folders in an Explorer window. I fired up Process Monitor and confirmed that nobody (not even Explorer) is writing to HKEY_CLASSES_ROOT.

Why are we getting spurious notifications? Have we misunderstood what this function does?

Everything is working as expected; it's just that your expectations are wrong.

Recall that the HKEY_CLASSES_ROOT registry key is really a combined view of HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. Specifically, it is a combined view of HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes. And HKEY_CURRENT_USER\Software\Classes is itself just an alias for HKEY_USERS\«SID»_Classes. Therefore, if you're going to look in Process Monitor, you need to be looking at all of those locations to see changes that eventually get reported as changes in HKEY_CLASSES_ROOT.

In this particular case, Explorer was making changes to HKEY_USERS\«SID»_Classes\Local Settings, which shows up as HKEY_CLASSES_ROOT\Local Settings.

Upon receiving this explanation, the customer understood what was going on, and also remarked that they were going to look to see if they could register their notification on a location that isn't quite so broad.

Comments (23)
  1. Brian_EE says:

    I still don't understand, Ray, why you put up with xpclient's continual habit of being the first person to rate and always rating it a "1-star" (like today, again), not to mention his acerbic comments and troll baiting.

    On-topic, you know people are going to wonder what the customer was trying to accomplish, but I'm sure you don't know, or you would have incorporated it in the story.

    [I pay no attention to the ratings; my eyes don't even see them. Ratings are useless because you don't know whether a low rating means "This topic is not interesting" or "I disagree with this article" or "The article is too technical" or "The article is not technical enough" or "The article is poorly-written" or "I deplore the behavior described in this article" or "I think it sucks that the issue discussed in this article even exists". The response to each type of feedback is different. -Raymond,/I>]
  2. Chris B says:

    I think this is the first time I've seen a Q/A entry end with the customer having a reasonable reaction to the answer. It's refreshing.

  3. gubment.cheez says:

    @Brian_EE please don't feed the trolls. they will be taken out and runned when time is available

  4. John Ludlow says:

    It's also not an unreasonable assumption that the modifications would have shown up in ProcMon. And they even considered that they might be at fault in the original question (assuming Raymond hasn't reworded it). There may be hope yet…

    They may have been doing something like having a systray app wait for a COM component to be registered.

  5. Lars Viklund says:

    Notification area, you mean?

    (as a side note, I miss Mr. Diamond's comments)

  6. Paul Parks says:

    @Brian_EE: I make a point of rating the new article every day now. If enough of us do that it should flood out xpclient's silliness.

    I like the way Codeproject handles ratings. It has a system where statistical outliers are tossed out.

  7. barf says:

    Statistically speaking, sycophants are just as bad a trolls.

  8. Matt says:

    @Barf: Really, the problem is people who rate something consistently high or low.

    The bit that gets me is that if xpclient thinks that every single post by Raymond is cr4p, why does he not just go away and read a different blog? It's not like there's a shortage of other stuff to do on the Internets.

  9. Joshua says:

    @Matt: see attractive nuisance

    filler text to get past spam filter

  10. alegr1 says:

    I wonder why Reg­Notify­Change­Key­Value function name in the article has to include the invisible hyphen characters, so if I copy-paste it to the help viewer it doesn't find anything.

    [So that it line-breaks nicely. I thought that was obvious. -Raymond]
  11. Joshua says:

    @alegrl: Pro tip: the copy in the declaration doesn't have them.

    more filler text

  12. StackedCrooked says:

    Upon receiving this explanation, the customer understood what was going on, and also remarked that they were going to look to see if they could register their notification on a location that isn't quite so broad.

    I feel relieved to learn that in the end everything turned out OK.

  13. Iphoner says:

    If formatting was important, this blog (main page) would display correctly in other browsers than IE.

    [Looks good to me in FF17. -Raymond]
  14. Matt says:

    Works for me in Chrome.

  15. Michael Kopinsky says:

    blogs.msdn.com/…/oldnewthing looks messed up for me on Chrome 18 for Android. The blog entries only occupy the left ~55% of the screen.

  16. Drak says:

    Interesting post. If I hadn't read it I would never have known about the way the Registry is actually views to other parts. This might help in future. Thanks Raymond!

  17. Scarlet Manuka says:

    @Iphoner, Michael Kopinsky: It displays properly with Chrome 23 on my desktop PC.

  18. Neil says:

    It even works properly in Firefox 4 for me. (There was a time where it didn't and I had to tweak the margin of the #content element and the padding of the .abbreviated-post class.)

  19. Matt says:

    @voo: All sites have major problems in every mobile browser I've ever tried. Singling out Raymond for criticise because the BB/Iphone/Android browser sucks is a bit unfair.

  20. erwin says:

    @Matt

    Looks good to me on sgs3 defalt browser

  21. Dave Bacher says:

    Looks fine on wp7, works fine on my laptop on opera, chrome, Firefox current on my laptop also… Haven't tried the iPod, because browsing on it is bad generally.

  22. voo says:

    The blog has *big* problems in every mobile browser I've ever tried, but at the same time works perfectly fine with every desktop browser I've tried. And really are we now arguing that Ray shouldn't make sure that linebreaks work sensibly in the blog? That's just stupid..

  23. Schabse Laks says:

    That sounds like an uncommonly good customer.

Comments are closed.

Skip to main content