I love Process Monitor from sysinternals.com

i love process monitor from sysinternals.com

the filter section is so awesome!

It is posible to create query to show what happens under HKCU.
It is posible to specify what registry operations you want to see :)
Is it query, open, set or close?

There operations in process monitor are calling:

• RegQueryValue
• RegOpenValue
• RegCloseKey
• and finaly RegSetValue!

At example above i make three filter options to query everything writed new with desktop visual effects.
I create three rules:
Operation is
RegSetValue

Path begins with
HKCU\Control Panel

and
Path begins with
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Now click changes to visual effect and click apply:

When you press apply button you can actually see that UserPreferencesMask get his actual value with more than one step.

You can see every new registry write, rewrite or new key created: