Tutorial Windows: How to Track and Monitor Every System Change in Windows
Simply having an antivirus installed on your Windows PC doesn’t mean it’s completely safe, especially with all the various threats that lurk in every corner of the Internet. Sometimes, taking matters into your own hands is the best solution.
Whenever an application is installed on your computer, it makes some changes to your system so that it can perfectly run alongside other components or programs that are already there. Some might have a huge impact on functionality and stability, which can lead to overall failure, and this is one scenario an antivirus stands no chance against.
However, there’s the possibility of taking snapshots of your computer’s configuration at the point where you consider it’s stable, and then compare it with newer snapshots to see what changes were made, and where.
There isn’t a Windows default feature to handle this task, but there is a utility developed by Microsoft in this regard. Needless to say that there are also some alternatives, and we’re going to see how they can be used.
The Microsoft solution
Named Windows System State Monitor, the application is capable of keeping an eye on certain areas of your computer, such as the file system, registries, services, and drivers. Once monitoring is started, changes are detected, so you can take action and prevent any suspicious programs from infiltrating your PC.
|Part 1: Windows System State Monitor|
The first thing you need to do is go grab the application for the right architecture. Don’t get fooled by the name, because the component of interest is inside the bundle. You can find the download links below.
|–> Server Logo Program Software Certification Tool x86 <–|
|–> Server Logo Program Software Certification Tool x64 <–|
Once installed, look for the Windows System State Monitor executable and launch it. A small window needs to appear, showing computer and user name, the operating system (and yes, it works with Windows 10 too), as well as current date/time.
Depending on what you want to monitor, several areas can be selected. As mentioned above, a simple mouse click is enough to check or remove them from the list. When you’re ready, hit the Start Monitoring button.
All that’s left to do now is minimize the application and go on with whatever it is you were doing. Every change in the selected areas is tracked until you decide to Stop Monitoring. In the end, there’s the possibility of pressing Create Report, with various logs and an HTML file saved to a custom location.
Note that every change to your computer in the monitoring interval is tracked, so it’s best to only focus on a single task if you’re really looking to catch specific changes to your system.
|Part 2: Windows System State Analyzer|
But wait, there’s more! The package also deploys a Windows System State Analyzer component, which is used in the same regard, but this one is for the long shot. In other words, the analyzer is used to compare two snapshots taken at different times.
If you don’t already have a snapshot of your computer, and you probably don’t, the first step is to take one. Don’t just rush to press the Start button unless you want the whole system to be analyzed, which can take a considerable amount of time.
Access the Tools menu to go to Options. There, remove the right panel items you don’t want to be scanned, or add those you want from the left panel. Hit Apply and OK to confirm. Back in the main window, there’s the possibility of choosing a Snapshot Name for easy identification, and it can be Pre install, Post install, Pre configuration, Post configuration, Post primary functionality, Uninstall, or even Custom.
Press the Start button so the snapshot is taken. Then, perform all operations you need, and take another snapshot with the same options. When you have the two BIN files, load one in each of the two panels of the System State Analyzer main window, and hit Compare. Once the application processes your request, and saves the log file, it’s automatically opened in your default viewer.
Note: The utility is also capable of tracking removed items, just in case you notice something’s missing. That’s why it’s good to have a snapshot of the whole system with its normal functioning state, so you can later on compare it to others.
The third-party alternatives
|Designed with a similar concept in mind, this application takes a more professional approach to the situation. In other words, it makes it much easier to monitor areas of your system, with real-time notification of changes, and possibility of taking action on existing items. As such, you get to keep an eye on Startup Programs, Delayed Start, Scheduled Tasks, Services, Active Tasks, Cookies, File Types, Hidden Files, Recent, System Registry, and more. Download and info here.|
|In case you’re only interested in files, this small application is capable of detecting even the slightest change in files. It lets you pick a folder to monitor, choose file types to exclude, and even have a report generated in the end. As you can see, it immediately started detecting all temp frames created for the recording below, all this done in real time. You can get it here.|
If you know you’re practically working in the no man’s land of the virtual world, it’s best to be equipped with more than just an antivirus or active firewall. These aren’t the only solutions though, as you can install an application in a sandbox virtual environment, and even an entire operating system in a virtual machine.