如何确定Windows注册表中哪个键值项发生了变更

RegNotifyChangeKeyValue() 函数可检测到注册表发生了某种变更，如何确定具体是哪个键值项发生了变更？（无需对比变更前后的整个注册表状态）

更新：已尝试的方法 #

1. RegNotifyChangeKeyValue() #

import winreg
import ctypes
advapi32 = ctypes.WinDLL("Advapi32.dll")

hive = winreg.HKEY_LOCAL_MACHINE
key_path = r""
event = ctypes.windll.kernel32.CreateEventW(None, True, False, None)
rc = advapi32.RegNotifyChangeKeyValue(
    key.handle,
    True,  # 监控子键
    REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET,
    event,
    True   # 异步模式
) # -> int

该方法可监控整个子键树，但无法告知具体是哪个子键发生了变更。

2. WMI 的 RegistryKeyChangeEvent #

它仅能监控单个键值项。若尝试不设置AND KeyPath='...'会出现报错：

>>> from win32com.client import GetObject
>>> wmi = GetObject("winmgmts:\\.\root\default")
>>> wmi.ExecNotificationQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' ")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<COMObject winmgmts:\.\root\default>", line 2, in ExecNotificationQuery
  File "C:\Users\FeelUs\miniforge3\envs\py12\Lib\site-packages\win32com\client\dynamic.py", line 355, in _ApplyTypes_
    result = self._oleobj_.InvokeTypes(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^
pywintypes.com_error: (-2147352567, 'Error.', (0, 'SWbemServicesEx', 'Provider registration overlaps with the system event domain ', None, 0, -2147213311), None)

当前使用的pywin32版本信息：

(py12) C:\Users\FeelUs\tmp\files-db>pip show pywin32
Name: pywin32
Version: 307
Summary: Python for Window Extensions
Author: Mark Hammond (et al)
Author-email: mhammond@skippinet.com.au
License: PSF
Location: C:\Users\FeelUs\miniforge3\envs\py12\Lib\site-packages
Requires:
Required-by: jupyter_core, plumbum, pypiwin32, WMI

报错出现在win32com\client\dynamic.py第336行。

3. WMI 的 RegistryTreeChangeEvent #

from win32com.client import GetObject
wmi = GetObject("winmgmts:\\.\root\default")
watcher = wmi.ExecNotificationQuery(
    "SELECT * FROM RegistryTreeChangeEvent"
    "WHERE Hive = 'HKEY_LOCAL_MACHINE' AND RootPath = '' "
)
while True:
    event = watcher.NextEvent()
    print(event.Path_) # -> <COMObject <unknown>>
    print(event.Path_.Path) # -> '' for any path

其表现与RegNotifyChangeKeyValue类似：事件无法告知具体哪个子键发生了变更。

4. 创建并安装注册表过滤驱动 #

需要在Visual Studio中编译、进行数字签名、安装……这对于该任务来说过于繁琐，是否有更简便的方法？

内容的提问来源于stack exchange，提问作者Филя Усков