监控注册表值并修改

[zss427607]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Licensing Core，在该键下一个名为“EnableConcurrentSessions”的DWORD值，该值的数据为1。

各位如何监视以上注册表的值是否为“1“，如果不是就进行修改使之为1、是的话无动作。



不知能否实现以上功能



先谢谢了

[嗷嗷叫的老马]

简单点的,用个定时器,定期查询,不是1就改成1......

复杂点的恐怕你是做不了,即拦截注册表操作的相关API,进行监控....

据说需要写驱动?或者要进行RING3下的全局拦截之类??

[zss427607]

可以 上传个实例吗

[嗷嗷叫的老马]

添加一个模块:

http://www.m5home.com/bbs/dispbbs.asp?boardid=28&Id=422&page=2

然后在一个定时器里写代码:

private sub timer1_timer()
    if GetDWORDValue("HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Licensing Core","EnableConcurrentSessions")<>1 then
        call SetDWORDValue("HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Licensing Core","EnableConcurrentSessions",1)
    end if
end sub

[threenewbee]

拦截API函数。
我的[URL=http://blog.caozhongyan.com]BLOG[/URL]有。

[of123]

不需要那么复杂，微软已经提供了 RegNotifyChangeKeyValue 函数。下面是例子：

Option Explicit

'This program shows you how to use the RegNotifyChangeKeyValue-function
'As its name predicts, RegNotifyChangeKeyValue will notify our program
'when the registry changes.
'Follow these steps to test this program:
'1. Start this program
'2. Start Regedit.exe (located in your Windows-directory)
'3. Go to HKEY_CURRENT_USER
'4. Change the value of HKEY_CURRENT_USER
'5. You will see that our program returns from the RegNotifyChangeKeyValue

'WARNING: Playing with the registry can have serious consequences !
' If you don't know what you're doing, I advise you not to delete anything

Const HKEY_CLASSES_ROOT = &H80000000
Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
Const REG_NOTIFY_CHANGE_NAME = &H1 ' Create or delete (child)
Const REG_NOTIFY_CHANGE_ATTRIBUTES = &H2
Const REG_NOTIFY_CHANGE_LAST_SET = &H4 ' time stamp
Const REG_NOTIFY_CHANGE_SECURITY = &H8
Const REG_NOTIFY_ALL = (REG_NOTIFY_CHANGE_NAME Or REG_NOTIFY_CHANGE_ATTRIBUTES Or REG_NOTIFY_CHANGE_LAST_SET Or REG_NOTIFY_CHANGE_SECURITY)
Private Declare Function RegNotifyChangeKeyValue Lib "advapi32" (ByVal hKey As Long, ByVal bWatchSubtree As Boolean, ByVal dwNotifyFilter As Long, ByVal hEvent As Long, ByVal fAsynchronous As Boolean) As Long
Private Sub Form_Load()
'Create a temporary registry key
SaveSetting "Registry Notification", "Hello", "Testing", "123"
'Call the function .. This will notify us when something changes at HKEY_CURRENT_USER
RegNotifyChangeKeyValue HKEY_CURRENT_USER, True, REG_NOTIFY_ALL, ByVal 0&, False
MsgBox "Registry changed"
Unload Me
End Sub

[chenhui530]

微软公开的或者常用的一些方法，比如微点提供的api都是事后处理，还有比如象wmi等都是这样
如果要事先处理最好是拦截api或者事先触发的回调，好像只有2003支持

[zss427607]

各位 高人
谢谢了