title: Windows Registry Monitoring for change using C++
body: <p>I have following piece of code that is working on the following steps:</p>
  
  <ol>
  <li>Open the RegistryKey using <code>RegOpenKeyEx</code></li>
  <li>After opening key, Create a event using <code>CreateEvent</code>.</li>
  <li>Using <code>RegNotifyChangeKeyValue</code> for getting Notification.</li>
  </ol>
  
  <p>The above steps only gives me a notification of change occured but not the information on where the change occured. eg consider following code:</p>
  
  <pre><code>#include &lt;Windows.h&gt;
  #include &lt;iostream&gt;
  #include &lt;string&gt;
  
  int main()
  {
      DWORD  dwFilter = REG_NOTIFY_CHANGE_NAME|
                       REG_NOTIFY_CHANGE_ATTRIBUTES |
                       REG_NOTIFY_CHANGE_LAST_SET |
                       REG_NOTIFY_CHANGE_SECURITY;
  
      HKEY pHresult=0;
      if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\aaaa",0,KEY_NOTIFY|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_QUERY_VALUE|KEY_WOW64_64KEY,&amp;pHresult)!=ERROR_SUCCESS){
          std::cout &lt;&lt; "FAIL IN OPEN SOFTWARE" &lt;&lt; std::endl;
      }
      std::cout &lt;&lt; " OPEN software//aaaa" &lt;&lt; std::endl;
  
      while(1)
      {   
          HANDLE hevent = CreateEvent(NULL,FALSE, TRUE, NULL);
          if(RegNotifyChangeKeyValue(pHresult,TRUE,dwFilter,hevent,TRUE) != ERROR_SUCCESS)
          {
              std::cout &lt;&lt; "NOTIFICATION FAILED " &lt;&lt; std::endl;
          }
  
          DWORD dwret = WaitForSingleObject(hevent, 2000);    
          if(dwret == WAIT_TIMEOUT)
          {
              std::cout &lt;&lt; " TIMEOUT " &lt;&lt; std::endl;
          }
          else if (dwret == WAIT_FAILED)
          {
              //
          }
          else
          {
              std::cout &lt;&lt; "Change Occured" &lt;&lt; std::endl;
          }
  
          //Sleep(2000);
      }
      RegCloseKey(pHresult);
  }
  </code></pre>
  
  <p>In above code, if change is done in <code>aaaa</code>, i get <code>Change Occured</code>. How do I get the location where the change occured. One way would be using recursion and scanning the whole path. Is there any better way or API for reducing the overhead of recursion way?</p>