You could also be having a conflict where two applications are trying to access the registry key at the same time, and causing it to be lost. I would at least backup that registry key so you can easily restore when needed.
Are you using Malwarebytes Premium? Perhaps its settings for registering on the Windows Security Center are causing the issue. If you haven't already, try setting it to never register.
What @mood suggested previously or using another security solution that can selectively monitor registry modification activity is the only way you're going to be able to definitively find out what app is deleting the registry key.
I'm inclined to agree. I also agree with you itman, but for now I'm not sure I need anymore programs installed. I've just found that bleepingcomputer have created the required registry key if anyone needs it. https://www.bleepingcomputer.com/ne...curity-updates-unless-avs-set-a-registry-key/ You'll find it right at the bottom of that page (before the comments). I'm downloading to all machines in case I need it in the future.
Hi @mood , I've taken your advice. I trust you and I certainly trust the dev' so I guess I've got nothing to lose. Thanks for your advice as always. As suggested, I deleted EVERYTHING in the Rules.DB, pasted your code and saved as Rules.DB. I guess the culprit will show up before long. Now we wait.
Just wondering if this would help to find out some info http://www.morgantechspace.com/2015/01/how-to-track-registry-changes-in-windows.html
@stapp , the same thing is mentioned in #19 by Cutting_Edgetech. I personally also recommend registry audit.
The key comes and goes all by itself. It is back again on this machine at the moment. If the key is only needed for Windows updates I have a copy if and when I need it. I'm over trying to sort it. My head hurts. Thanks again for all the suggestions.
I wouldn't bother with it, if OS updates run OK. Maybe system is doing something by itself, especially if you have WD enabled and running.
Per the bleepingcomputer.com link posted above: It is possible the Window Defender Security Center on Win 10 1709 "does something" with the key when WD is the active realtime AV employed. Also I believe you keep switching back and forth between Norton and WD which I am sure not helping in regards to this issue.
Actually, I only reinstalled Norton because this issue has been bugging me while using WD. The key is currently present on this machine once again.
FYI: I use CCEnhancer and have no issues with that registry key. You might try MJ RegWatcher and add key to be monitored. https://jacobsm.com/mjsoft.htm#rgwtchr I launch it from an elevated shortcut. If performance suffers you can adjust these settings: Use additional keys editor to add key: Then back in the main window prefix keys like this: $hkey_lmus\software\microsoft\windows\currentversion\qualitycompat $hkey_lmus\software\microsoft\windows\currentversion\qualitycompat\cadca5fe-87d3-4b96-b7fb-a231484277cc So you end up with: Then save changes and relaunch MJ RegWatcher. If the key(s) get modified or deleted you should get a time stamped alert. Hopefully you get the process name but if not check the log viewer for process launches at that time or maybe additionally run ProcessLoggerService and compare logs. https://www.wilderssecurity.com/threads/process-logger-service.392757/
This is a non-issue now anyway. https://www.wilderssecurity.com/thr...-windows-redesign.399338/page-42#post-2744141