A customer had a question about the
We are using it to monitor the
HKEY_tree as follows:
CLASSES_ ROOTRegNotifyChangeKeyValue( HKEY_CLASSES_ROOT, true, // monitor entire subtree REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, eventRegKeyChanged, true); // asynchronous mode
If I understand the documentation correctly, this registers for notifications when subkeys are added, deleted, or when values are changed. However, it seems that my event becomes signaled at many other times, for example, when I switch folders in an Explorer window. I fired up Process Monitor and confirmed that nobody (not even Explorer) is writing to
Why are we getting spurious notifications? Have we misunderstood what this function does?
Everything is working as expected; it’s just that your expectations are wrong.
Recall that the
HKEY_ registry key
is really a
combined view of
Specifically, it is a combined view of
is itself just an alias for
Therefore, if you’re going to look in
you need to be looking at all of those locations to see changes
that eventually get reported as changes in
In this particular case, Explorer was making changes to
which shows up as
Upon receiving this explanation, the customer understood what was going on, and also remarked that they were going to look to see if they could register their notification on a location that isn’t quite so broad.