Skip to main content
Operating system & services

Registry Change

Baseline Windows registry keys and get alerted about new autostart entries or changed settings.

On its first run, the Registry Change check stores the values under the specified Windows registry keys as a baseline, and from then on it reports any deviation. This lets you notice, for example, new autostart entries under HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or changed security settings. The check runs through the octoja agent directly on the Windows device (x64 and Arm64), every 60 minutes by default. Linux and macOS are not supported.

Steps

  1. Go to Devices and open the device.
  2. Click the Checks tab → Add Check → Registry Change.
  3. Enter the keys to monitor under Registry keys.
  4. Click Add Check.

Alternatively, assign the check with a config package.

Settings

FieldTypeRequiredDefaultDescription
Registry keysList of stringsYes—Keys to baseline in PowerShell format, e.g. HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Include subkeysBooleanNoNoAlso includes the values of all subkeys
Report change as criticalBooleanNoNoReports a detected change as Critical instead of Warning
Accept current values (reset baseline)BooleanNoNoStores the current state as the new baseline on the next run

What is compared

For each key, the check records the names and data of all values, and with Include subkeys also those of the subkeys. New, deleted or changed values are detected, as is a key that disappears or is created. A new subkey without values of its own does not change the signature, however.

  • A change that is made and reverted between two runs goes unnoticed.
  • The agent stores the baseline locally on the device, separately for each key list. If you change the list, the next run creates a new baseline and reports OK.
  • Toggling Include subkeys keeps the existing baseline. If the subkeys contain values, the next run therefore reports a change; accept the current values as described below.
  • Multiple keys are evaluated together: the result tells you that something changed, not which value. Monitor keys you need to tell apart in separate checks.

Results

SituationResult
First run (no baseline yet)OK, the check details show Baseline established
Values match the baselineOK, No change since baseline
Values differ from the baselineWarning, or Critical with Report change as critical; the check details show Registry changed since baseline
Registry keys is emptyWarning, No keys configured
The registry query fails as a wholeFailure, Registry query failed

The check details list each key with a shortened signature, or the note missing if the key does not exist or could not be read.

Acknowledge a change

A detected change stays reported until you accept the new values — the check does not update the baseline on its own.

  1. In the check configuration, enable Accept current values (reset baseline) and save.
  2. Wait for the next run. The check stores the current state as the new baseline and reports OK.
  3. Disable the option again.

Warning: While Accept current values (reset baseline) is enabled, every run overwrites the baseline and reports OK. The check detects no changes during that time.

Was this helpful?

Still need help? Ask the team