RegistryTreeChangeEvent class

Applies to: desktop apps only

The RegistryTreeChangeEvent class represents changes to a key and its subkeys. For more information about using the WMI registry event classes, see the Modifying the System Registry section. For code examples, see the WMI Tasks: Registry topic.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

class RegistryTreeChangeEvent :  RegistryEvent
{
  string Hive;
  string RootPath;
  uint8  SECURITY_DESCRIPTOR[];
  uint64 TIME_CREATED;
};

Members

The RegistryTreeChangeEvent class inherits from RegistryEvent. RegistryTreeChangeEvent also has these types of members:

• Properties

Properties

The RegistryTreeChangeEvent class has these properties.

Hive

Data type: string

Access type: Read-only

Name of the hive that contains the key (or keys) that is changed. For example, HKEY_LOCAL_MACHINE. Changes to the HKEY_CLASSES_ROOT and HKEY_CURRENT_USER hives are not supported by RegistryEvent or classes derived from it, such as RegistryTreeChangeEvent.

RootPath

Data type: string

Access type: Read/write

Path to the registry key that contains the subkeys. For example, "SOFTWARE\Microsoft".

SECURITY_DESCRIPTOR

Data type: uint8 array

Access type: Read-only

Descriptor that the event provider uses to determine which users can receive an event. This property is inherited from __Event. A NULL access control list (ACL) in the SECURITY_DESCRIPTOR grants unlimited access to everyone all the time. For more information, see Creating a Security Descriptor for a New Object.

Windows 2000:  Not available.

TIME_CREATED

Data type: uint64

Access type: Read-only

Unique value that indicates the time when an event is generated. This is a 64-bit FILETIME value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Time (UTC) format. This property is inherited from __Event. To convert this value to other time formats, use the SWbemDateTime methods SetFileTime and GetFileTime. For more information, see WMI Tasks: Dates and Times.

Windows 2000:  Not available.

For more information about using uint64 values in scripts, see Scripting in WMI.

Remarks

Queries that provide a RootPath must have backslashes escaped. For example,

wmiServices.ExecNotificationQuery(_  
    & "SELECT * FROM RegistryTreeChangeEvent " _
    & "WHERE Hive='HKEY_LOCAL_MACHINE' AND " _
    & "RootPath='SOFTWARE\\Microsoft'")

Registry provider classes, unlike most of the Win32 classes are located in the WMI root\default namespace.

Examples

For script code examples, see WMI Tasks for Scripts and Applications and the TechNet ScriptCenter Script Repository.

For C++ code examples, see WMI C++ Application Examples.

The following script runs until the computer is restarted, WMI is stopped, or the script is stopped. To stop the script manually, use Task Manager to stop the process. To stop it programmatically, use the Terminate method in the Win32_Process class.

wbemFlagReturnImmediately = 16
wbemFlagForwardOnly = 32
IFlags = wbemFlagReturnImmediately + wbemFlagForwardOnly

Set wmiServices = GetObject("winmgmts:root/default") 
Set dtmCreateTime = CreateObject("WbemScripting.SWbemDateTime")

Set colRegChanges = wmiServices.ExecNotificationQuery _
    ("SELECT * FROM RegistryTreeChangeEvent " _
    & "WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath=''",, IFlags)

Do While (True)
   Set TreeChange = colRegChanges.NextEvent

'Time_Created property is 64-bit and
' must be converted into CIM_DateTime format
   dtmCreateTime.SetFileTime TreeChange.Time_Created, false

'Convert to VT_DATE format using GetVarDate
' for printing to screen
   Wscript.Echo "Time = " & dtmCreateTime.GetVarDate() _
              & VBNewLine _
              & "Hive = " & TreeChange.Hive & VBNewLine _
              & "RootPath = "& TreeChange.RootPath    
Loop

Requirements

See also

Registering for System Registry Events

Send comments about this topic to Microsoft

Build date: 3/9/2012