Windows Tip Sheet
Go Back in Time -- For Free
Track registry changes with the free Keytimes.exe command-line tool.
This tip is part 2 in a series of 4 on cool command-line freeware.
Ever need to audit registry changes and figure out when a particular change
was made? It’s actually a bit difficult, but there’s a free command-line
tool called Keytimes.exe that’ll tell you what you need to know. Download
it and just run:
To list all keys in HKEY_LOCAL_MACHINE (or specify hkcu,
hkcr, hku or all for
other hives) and the time and date each key was last changed. You can also filter
to help cut down the mass of output -- just use the "/?"
command-line argument to get help on the command.
Doing a before-and-after run with Keytimes is a great way to see what changes
have been made by an application, an installation or other activity.
- Download the tool here.
- More cool tools and documentation for Keytimes can be found here.
Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is an Author/Evangelist for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.