How to see changes being done to registry?

Question

I am using StartAllBack to customize my Win11, but I would like to switch to Start11. The thing is SAB has a feature where it colorizes even dialog windows like copy/move dialogs and errors and I would like to keep those. I am pretty sure SAB just edits a few registry entries and I would like to identify which ones. I tried Event Viewer but I did not find anything, probably used it wrong. Any tips on identifying these changes?

Answer 1

Use sysinternals "Procmon"

You will need to create filters to make the information digestible to normal human beings.

1. Isolate Process name contains StartAllBack (assuming that the process name contains this).

2. Isolate Operation starts with reg

3. Do the deed.

4. Examine the output.

Filter more as needed.

Rejoice.

Answer 2

Use a tool such as free Nirsoft's RegistryChangesView or Sysinternals' Process Monitor to capture the state of the registry before installing SAB and after its installation, and use the tool to "diff" the two to see only changes. There are more alternatives to those tools.

See also this Super User answer.

Of course, check any software at VirusTotal before installing.