Using Process Monitor (ProcMon) to Track File and Registry Changes

6.8K

Process Monitor (ProcMon) is an advanced Windows troubleshooting tool that provides real-time visibility into file system, Registry, and process/thread activity. It captures detailed operation parameters and results and supports powerful, non-destructive filtering, thread stacks, process info, and boot-time logging. Our guide was reviewed with Process Monitor 4.11, released on September 10, 2026.

What can you do with ProcMon?

• Track the startup and shutdown events of processes and threads, including information about the exit code (the utility captures the Process Exit event, which provides the Exit Status);
• Collect data on the parameters of input and output operations. Important to note that this tool not only shows those parameters, but it shows the Result (e.g., SUCCESS, NAME NOT FOUND, ACCESS DENIED);
• Set filters to display only the necessary information. For example, about the actions of a specific process, access to a specific file or a registry key;
• Log all operations during system boot (starting processes, services, driver loading). This is useful for diagnosing slow Windows boot.
• Monitor IPC activity involving named pipes and mailslots, a capability introduced in ProcMon 4.1.

ProcMon installation

ProcMon is not a built-in system utility, so you must download it manually from the Microsoft website. Process Monitor does not require installation. Extract the archive and run the procmon.exe (procmon64.exe or Procmon64a.exe for ARM64 architecture) executable file as an administrator.

When you start Process Monitor for the first time, a license agreement (EULA) appears on the screen that requires user confirmation (however, when automating or scripting, users can bypass the EULA window using the /AcceptEula command).

When ProcMon starts, it installs a special system driver PROCMON24.SYS. It captures low-level system activity related to file system operations, Registry access, and process/thread activity.

ProcMon installation using winget

1. Open PowerShell or Command Prompt as an Administrator.
2. Run the following command:
   

   winget install Microsoft.Sysinternals.ProcessMonitor

   
3. Once the process completes, you can launch the tool by typing procmon in the terminal or through the Start menu.

Using Process Monitor to Track File and Registry Changes

In this article, we will show how to track accesses and changes to files and registry on your local computer using Process Monitor.

Let’s say you need to track access to the registry key HKEY_CURRENT_USER\Software\test and file c:\ps\procmon_example.txt.

When Process Monitor starts, it begins capturing all events according to the default filters.

Stop capturing events by unchecking the option File > Capture Events (Ctrl+E) and clear the current ProcMon log (Edit > Clear Display).

Configuring the Process Monitor filters

Now you need to configure the Process Monitor filters (Filter > Filter). The filters allow you to specify various criteria for events to be added or excluded from the monitoring.

The default filter already excludes events of a standard Windows system activity and the procmon.exe process itself. In most cases, you don’t need to remove these filters. We’ll add some additional filters.

Create a filter for monitoring access to the registry key: Path > contains > \SOFTWARE\test > Include. Click Add to add a new filter to the list.

Now add a file access event filter: Path > is > c:\ps\procmon_example.txt > Include.

Make sure the following options are enabled in the ProcMon toolbar: Show Registry Activity, Show File System Activity. The Show Network Activity and Show Process, and Threads Activity options can be disabled.

Start event monitoring File > Capture Event.

Example

As an example, let’s create a registry value in the specified registry key using the command prompt:

reg add HKCU\Software\test /v MyEntry /t REG_EXPAND_SZ /d ^%SystemRoot^%

When running the command above interactively in Command Prompt, you need to escape the % characters with ^ so that the literal %SystemRoot% string is stored as REG_EXPAND_SZ. In a .bat or .cmd file, you should use %%SystemRoot%% instead.

Then, let’s write some data into the procmon_example.txt file using the command line:

echo %date%>>c:\ps\procmon_example.txt

And using PowerShell:

Get-Process|out-file C:\ps\procmon_example.txt

Switch to the ProcMon window. As you can see, ProcMon captures the RegCreateKey and RegSetValue operations (Operation > RegCreateKey). It also contains events of creation (Create File) and writing to a file (WriteFile) by the processes cmd.exe and powershell.exe.

The list of events contains the system process msmpeng.exe (Antimalware Service Executable). This is the core process of the antimalware detection engine in Windows Defender. To exclude the events of this process from the ProcMon log, right-click on the process name msmpeng.exe and select Exclude “….”.

This process will be added to the ProcMon filter with the Exclude value. It means that the ProcMon log won’t display any activity from this process.

In this way, exclude any other trusted processes that are accessing your file or registry key. Now, if any process running on Windows tries to read or write to a tracking file or registry key, you will see this event in Process Monitor.

For example, you want to monitor only write events to a file. Click in the ProcMon window on the line with the WriteFile operation type, and add this event to the Include filter (this will hide all other operations (like CreateFile or CloseFile).

Thus, any object or event in ProcMon can be added to the filters, so that the minimum set of events that you need to analyze access to a file or registry are displayed in front of you.

Hints. Running Process Monitor can negatively affect the performance of your computer. Regardless of the filters configured, it stores all events in RAM (even if they are not displayed in the window). If ProcMon has been running for a long time, it may take up all the available RAM. You can configure ProcMon to store events not in virtual memory but in a file on disk. To do this, select the File > Backing Files > Use File named, and specify the file name. If you want ProcMon to save only the events that match your filters and drop all the others, enable the option Filter > Drop Filtered Events.