Windows 95 and any applications that you run on it are constantly accessing and writing to the Registry. Perhaps seeing how the Windows 95 operating system and your applications use the Registry could help you to better understand how your system works. Well, now you can, using Regmon for Windows 95 (Regmon), a free utility by Mark Russinovich and Bryce Cogswell of System Internals that can be downloaded from the Internet. In this article, we'll show you how to download and install Regmon. We'll also demonstrate how you can use Regmon to become more familiar with the Windows 95 operating system, the Registry, and all of your applications.
Downloading and installing Regmon
Regmon is freeware that can be downloaded from www.sysinternals.com/regmon.htm. It's a GUI/device driver combination utility that allows you to monitor and display all Registry activity on a Windows 95 system in real time. The most current version available for downloading at the time of this writing is Version 3.5. To download Regmon, click on the link at the bottom of the Web page and save the 32KB self-extracting Zip file to a folder on your hard disk, such as C:\Regmon95. Once the Regmon file is downloaded, locate it in the Regmon95 folder and double-click on it to extract the Regmon utility and device driver. The folder that you place the unzipped files in is where Regmon.exe will run from. Make sure to keep the Regmon.exe and Regvxd.vxd files in the same folder.
Finally, installing and using Regmon is simply a matter of running the utility from the same folder as the Regvxd virtual device driver. Frequent users can create a shortcut to the utility by dragging the Regmon.exe icon to the desktop or to the Start menu. The target still points to the folder where you placed the files. Now you have quick and easy access to a real-time troubleshooting tool!
GUI features
The Regmon utility has an easy-to-use graphical user interface (GUI). The toolbar buttons shown in Figure A provide quick access to all of the GUI's features. They allow you to stop or start Event Capturing and/or Auto Scroll as well as to clear the display, filter Registry accesses, and find specific events. In addition, the Save button allows you to save sessions to an ASCII file for reference at a later date. This is helpful if you're using Regmon to troubleshoot a specific problem with an application or operating system function.
Figure A: Regmon is simple to use and contains several helpful features.
As soon as you launch the Regmon utility, it immediately begins tracking any calls Windows 95 or open applications make on the Registry. It can get difficult to monitor events as they scroll rapidly by the listview display because one event could use multiple processes. For example, printing a Microsoft Word document uses Winword, Spool32, and Explorer. We recommend toggling off the Auto Scroll feature so that it's easier to see where a particular task starts and stops.
As Figure B shows, as each event is printed to the display, it's tagged with a sequence number. Also listed is the process that made the call to the Registry along with the request that it made and the Registry keys that were queried. Regmon lets you know if the event was a success or if the particular setting wasn't found.
Figure B: Regmon displays information on all calls made to the Windows 95 Registry.
If you're looking for something in particular, perhaps which key is changed after altering a desktop setting, the Filter and Find functions can be helpful. The Filter function allows you to select which events you either want to see or don't want to see by filtering the process and/or path. For example, as Figure C shows, we had to type *McAfee* in the Path Exclude(s) text box to prevent Regmon from constantly monitoring our anti-virus scanner's activity. As with most applications, the asterisk (*) represents a wild card, the semi-colon (;) is used to separate multiple filter strings, and the filters are case-insensitive.
Figure C: You can filter in or out which pathnames and/or processes you want captured.
By placing a filter in the Process(es) text box, you're indicating that you only want to see calls made by that/those process(es). The Path Include(s) and Path Exclude(s) text boxes can be used either in combination or alone to specify which pathnames will be captured. If a particular filter shows in both text boxes, the filter in the Path Exclude(s) text box overrides it.
Using Regmon
The Regmon utility can serve several purposes. Not only can it help you to learn more about your operating system and applications, but it can also help you to customize any settings that can't be changed through the Control Panel. By tracking changes made to your Registry, you can learn where and how system settings are stored. For example, we were curious where taskbar settings are stored in the Registry, so we launched Regmon before accessing the Taskbar Properties dialog box. We noticed that as soon as we right-click on the taskbar and select Properties from the shortcut menu, Explorer queries the Registry for a NoSetTaskbar value, as shown in Figure D. If this value isn't found, the Taskbar Properties dialog box opens, allowing you to make changes. If this value is found, however, a system policy has been placed to keep the current user from altering the taskbar's properties. The message box shown in Figure E will be displayed.
Figure D: The Regmon utility allows you to see where Windows 95 settings are located in the Registry.
Figure E: The NoSetTaskbar value indicates that a policy exists that restricts the current user from changing the taskbar properties.
It's up to you as the user whether you want to have Regmon always running in the background, or want to launch it only to track specific processes. You may want to consider, however, that your system will be a bit slower with Regmon constantly running.
Conclusion
Applications and the Windows 95 operating system are constantly interacting with your system's Registry. Regmon for Windows 95 is a free utility that allows you to fully understand this interaction. It may even help you to resolve some unexplained problems you've been experiencing with your system.