Is there a way to view who modified a registry?

Question

I am attempting to debug some settings on a local web server and noticed some registries changed in the last few days. I am trying to hunt down which user modified the registry. is there a way to see who modified a registry?

Note: this is on a Windows Server 2003 platform and every user with remote desktop access to this machine will have their own unique username.

Answer 1

This information is not normally stored by Windows, so unless you were auditing registry changes, it is not possible. You can turn on auditing (built into windows) to capture registry changes (and other registry activity). The audit results are stored in the Windows event logs.

See MS article on auditing registry changes.

Auditing slows things down by quite a bit since the registry gets lots of activity. Audit as little as you need to accomplish your goals.