WMI:monitor registry change

Question

In my project ,i want to monitor sofeware installation and unstallation in my system, so i use WMI event mechanism,but now i encounter a problem and have a question.

problem:

i want to monitor HKLM'SOFTWARE\\Microsoft\\Windows\\currentversion\\unistall',but code[1] works error(ExecNotificationQueryAnsync failed with =0x80041058).while code[2] works ok,what's wrong?

[1]

hres = pSvc->ExecNotificationQueryAsync(
    _bstr_t("WQL"), 
    _bstr_t("SELECT * FROM RegistryTreeChangeEvent WITHIN 1 " "WHERE Hive='HKEY_LOCAL_MACHINE'" "AND RootPath='software\\Microsoft\\Windows\\currentversion\\unistall'"
    ), 
    WBEM_FLAG_SEND_STATUS, 
    NULL,   
    pStubSink);
[2]

hres = pSvc->ExecNotificationQueryAsync(
    _bstr_t("WQL"), 
    _bstr_t("SELECT * FROM RegistryTreeChangeEvent WITHIN 1 " "WHERE Hive='HKEY_LOCAL_MACHINE'" "AND RootPath='software'"
    ), 
    WBEM_FLAG_SEND_STATUS, 
    NULL,   
    pStubSink);

question：in My event consumer ,i want to get the software's name ,how can i do ?

thanks!!

Answer 1

只需使用

SELECT * FROM RegistryTreeChangeEvent WITHIN 1 " "WHERE Hive='HKEY_LOCAL_MACHINE'" "AND RootPath='software\\\\Microsoft\\\\Windows\\\\currentversion\\\\unistall'"