Windows Tip Sheet
Go Back in Time -- For Free
Track registry changes with the free Keytimes.exe command-line tool.
This tip is part 2 in a series of 4 on cool command-line freeware.
Ever need to audit registry changes and figure out when a particular change
was made? It’s actually a bit difficult, but there’s a free command-line
tool called Keytimes.exe that’ll tell you what you need to know. Download
it and just run:
Keytimes hklm
To list all keys in HKEY_LOCAL_MACHINE (or specify hkcu,
hkcr, hku or all for
other hives) and the time and date each key was last changed. You can also filter
to help cut down the mass of output -- just use the "/?"
command-line argument to get help on the command.
Doing a before-and-after run with Keytimes is a great way to see what changes
have been made by an application, an installation or other activity.
More Resources:
- Download the tool here.
- More cool tools and documentation for Keytimes can be found here.
About the Author
Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is Curriculum Director for IT Pro Content for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.