procedure TForm1.FormCreate(Sender: TObject);
begin
  RegMonitorThread := TRegMonitorThread.Create;
  with RegMonitorThread do
  begin
    FreeOnTerminate:=True;
    Wnd := Form1.Handle;
    Key := 'Software\ADP';
    RootKey := HKEY_LOCAL_MACHINE;
    WatchSub := True;
    Resume;
  end;
end;

Next, we add the code in the message handling procedure

procedure TForm1.WMREGCHANGE(var Msg: TMessage);
begin
 with Memo1.Lines
  Add('-----------------------------------');
  Add('Registry change at ' + DateTimeToStr(Now));
  Add(IntToStr(RegMonitorThread.ChangeData.RootKey) +
      ' - ' + RegMonitorThread.ChangeData.Key);
end;

The actual WMREGCHANGE procedure is declared as

procedure WMREGCHANGE(var Msg : TMessage); 
          message WM_REGCHANGE;

The above procedure responds to a WM_REGCHANGE message defined in the TRegMonitorThread class as a user defined message.

This is how the "program" looks at run time (after some manual Registry editing)

As you can see, the code "only" reports that a change has been captured, it does provide the time of the change but no other information like, for example, the name of the key added / deleted / edited.
After you have trapped the change in Registry you could, for example, iterate through all the keys you are interested in and compare them to some values that *should* be there. All in all, what you will do with the change remains for you to handle.

Source code

If you have any questions please post to the Delphi Programming Forum.

Next page > Full Source Code > Page 1, 2, 3, 4