I have added this to the list of rules: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components* The problem is, when I run a program that creates a new key under that key, RegMonitor doesn't catch it. I can't figure out why. The program creates a key, and then creates a string value under the newly created key. Any ideas? Edit: I added another * to the end of the rule, and it worked. But what's the difference of using 1 or 2 *'s?