C# 监视注册表的更改

直接上代码，首先是一个简单的类示例，用于演示注册表的监视，记得要引用 System.Management

using System;
using System.Collections.Generic;
using System.Linq;
using System.Management;
using System.Security.Principal;
using System.Text;
using System.Threading.Tasks;

namespace WindowsFormsApp1
{
    public class RegistryWatcher
    {
        private ManagementEventWatcher _eventWatcher = null;

        /// <summary>
        /// 开始注册表监视
        /// </summary>
        public void StartWatcher()
        {
            try
            {
                // 先做一次关闭操作
                CloseWatcher();

                // 注意：路径分隔符需要连续两个分隔符
                string selectText = $@"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' AND ValueName='SecurityHealth'";

                // 创建查询
                WqlEventQuery regQuery = new WqlEventQuery(selectText);

                // 创建监视对象
                _eventWatcher = new ManagementEventWatcher(regQuery);
                _eventWatcher.EventArrived += new EventArrivedEventHandler(RegChangedHandleEvent);

                // 开始监视
                _eventWatcher.Start();
                Console.WriteLine($@"Waiting for an reg event...");
            }
            catch (ManagementException managementException)
            {
                Console.WriteLine("An error occurred: " + managementException.Message);
            }
        }


        /// <summary>
        /// 关闭注册表监视
        /// </summary>
        public void CloseWatcher()
        {
            try
            {
                if (_eventWatcher != null)
                {
                    _eventWatcher.EventArrived -= new EventArrivedEventHandler(RegChangedHandleEvent);
                    _eventWatcher.Stop();
                    _eventWatcher = null;

                }
            }
            catch (Exception)
            { }
        }

        /// <summary>
        /// 监视事件到达
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void RegChangedHandleEvent(object sender, EventArrivedEventArgs e)
        {
            Console.WriteLine($@"The specified registry value changed ...");

            // 其它代码：如取出注册表值看看改成什么了。事件参数不会有注册表的值信息，需要自己写代码去处理
        }

    }
}

其次是调用代码，在 WinForm 里面测试，代码如下
 

namespace WindowsFormsApp1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        /// <summary>
        /// 定义类的变量
        /// </summary>
        private RegistryWatcher _registryWatcherObject = new RegistryWatcher();

        /// <summary>
        /// 开始监视
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnTestStart_Click(object sender, EventArgs e)
        {
            _registryWatcherObject.StartWatcher();
        }

        /// <summary>
        /// 结束监视
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnTestClose_Click(object sender, EventArgs e)
        {
            _registryWatcherObject.CloseWatcher();
        }

    } 
}