How to Use the Windows Sysinternals Process Monitor (ProcMon) to Trace Registry Access Denied Errors

When troubleshooting legacy Windows applications, system administrators frequently encounter scenarios where a program inexplicably crashes, fails to save settings, or refuses to launch. These silent failures are often caused by hidden “Access Denied” errors when the application attempts to read or modify a specific Windows Registry key but lacks the required NTFS or Registry ACL (Access Control List) permissions. Because legacy applications rarely log these specific permission failures to the Windows Event Viewer, diagnosing the root cause is virtually impossible without specialized tracing tools. To definitively identify the exact registry key causing the failure, Windows engineers must utilize the Sysinternals Process Monitor (ProcMon).

Understanding Process Monitor (ProcMon)

Process Monitor is an advanced, kernel-level monitoring tool provided directly by Microsoft as part of the Sysinternals Suite. Unlike the standard Task Manager, which merely shows current resource consumption, ProcMon intercepts and logs every single File System, Registry, Network, and Process/Thread activity occurring across the entire Windows operating system in real-time.

Because ProcMon logs tens of thousands of events per second, attempting to read the raw, unfiltered output is overwhelming. The key to successfully diagnosing an Access Denied error is applying rigorous, highly specific filters to isolate the failing application’s registry interactions.

Executing and Filtering the Trace

First, download the official Sysinternals Suite from Microsoft and extract Procmon.exe. Right-click the executable and select Run as administrator (kernel-level tracing requires elevated privileges).

Upon launch, ProcMon immediately begins capturing millions of events. Before reproducing the application error, you must stop the capture and configure your filters.

1. Click the Magnifying Glass icon in the toolbar (or press Ctrl+E) to pause the capture.
2. Click the Eraser icon (or press Ctrl+X) to clear the existing, irrelevant logs.
3. Click the Filter icon (or press Ctrl+L) to open the Process Monitor Filter dialog.

You must construct two critical rules to isolate the specific failure:

Rule 1: Isolate the Target Application

If the failing application is named LegacyFinanceApp.exe, create a rule to discard all traffic from the rest of the OS.

• Condition: Process Name | is | LegacyFinanceApp.exe
• Action: Include
• Click Add.

Rule 2: Isolate the Access Denied Result

Next, instruct ProcMon to only show events that actively resulted in a permission failure.

• Condition: Result | is | ACCESS DENIED
• Action: Include
• Click Add.
• Click OK to apply the filters.

Reproducing and Analyzing the Failure

With the filters configured, you are ready to trace the error.

1. Click the Magnifying Glass icon (Ctrl+E) to resume the capture.
2. Immediately launch the failing application (LegacyFinanceApp.exe) and perform the specific action that causes the crash or failure.
3. As soon as the application fails, switch back to ProcMon and click the Magnifying Glass icon again to stop the trace.

Because of your strict filters, the ProcMon window should now be entirely blank, except for a handful of entries. Look for the Operation column displaying RegOpenKey, RegCreateKey, or RegSetValue.

Examine the Path column for these entries. You will see the exact registry hive and key the application attempted to modify (e.g., HKLM\SOFTWARE\LegacyFinanceApp\Config). The Result column will definitively display ACCESS DENIED.

Remediating the Registry ACL

You have successfully identified the root cause. The legacy application, running under the context of a Standard User, requires Write access to a location within HKEY_LOCAL_MACHINE (which is strictly restricted to Administrators by default).

To resolve the issue without granting the user full local administrator rights, you simply modify the ACL of that specific registry key.

1. Press Win + R, type regedit, and press Enter (running as an Administrator).
2. Navigate to the exact path identified by ProcMon.
3. Right-click the target key (e.g., Config) and select Permissions.
4. Click Add, enter Users (or a specific Active Directory security group), and grant them Full Control or Modify permissions over that specific key.

Relaunch the application. It will now seamlessly write to the registry key, and the silent failure will be permanently resolved.