Windows Tip Sheet

Go Back in Time -- For Free

Track registry changes with the free Keytimes.exe command-line tool.

This tip is part 2 in a series of 4 on cool command-line freeware.

Ever need to audit registry changes and figure out when a particular change was made? It’s actually a bit difficult, but there’s a free command-line tool called Keytimes.exe that’ll tell you what you need to know. Download it and just run:

Keytimes hklm

To list all keys in HKEY_LOCAL_MACHINE (or specify hkcu, hkcr, hku or all for other hives) and the time and date each key was last changed. You can also filter to help cut down the mass of output -- just use the "/?" command-line argument to get help on the command.

Doing a before-and-after run with Keytimes is a great way to see what changes have been made by an application, an installation or other activity.

More Resources:

  • Download the tool here.
  • More cool tools and documentation for Keytimes can be found here.

About the Author

Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is an Author/Evangelist for video training company Pluralsight. Don is also a co-founder and President of, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at

comments powered by Disqus
Most   Popular

SharePoint Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.