Hi there, I've created a rule for testing purpose. Key: HKEY_LOCAL_MACHINE\Software Value: * Event: Create Key, Modify Key, Set Value, Delete Value Action: Ask User From understanding, it should pop up a warning when I create a key, modify a key, set a value, or delete a value. I tested this using regedit. However, it only pops up a warning box when I set a vale; nothing happens when I create a key under "HKEY_LOCAL_MACHINE\Software". To achieve what I want, I need to create two rules. If this is the correct solution, then why do you put all that event options in one place? Thanks!