Is this a bug?

Hi there,

I've created a rule for testing purpose.

Key: HKEY_LOCAL_MACHINE\Software
Value: *
Event: Create Key, Modify Key, Set Value, Delete Value
Action: Ask User

From understanding, it should pop up a warning when I create a key, modify a key, set a value, or delete a value. I tested this using regedit. However, it only pops up a warning box when I set a vale; nothing happens when I create a key under "HKEY_LOCAL_MACHINE\Software".

To achieve what I want, I need to create two rules. If this is the correct solution, then why do you put all that event options in one place?

Thanks!

 

I dunno, but try HKEY_LOCAL_MACHINE\Software** and see if that works.

If it does, then try HKEY_LOCAL_MACHINE\Software*

I think that if you are protecting HKEY_LOCAL_MACHINE\Software, you are only covering the 'Software' key and not its sub-keys, which is maybe what you want.

 

My edit button won't work, which is very frustrating; but line 2 above should read HKEY_LOCAL_MACHINE\Software\*