How to monitor which app in affecting Registry .

So as the title says , I have this weird issue , every time I start / restart the windows the powershell gets a disallow run key in registry .

Firstly I thought it's because of ExecutionPolicy but I set it to unrestricted and it doesn't change when I restart while when I delete the disallow run key from registry it appear with each re/start , so is there any app/method I can use to determine which app is writing registry ? I mean if I create another user it seems to be fine , so It must be an app on this user .

Thanks in advance

Welcome to the forum try RegMon 7.04 - Download

If you want to monitor changes in Windows registry, you could try Regshot, RegistryChangesView, or SpyMe Tools.

Samuria said:

Welcome to the forum try RegMon 7.04 - Download

Well that's a great suggestion , since it's not working on Windows 10 , I downloaded the Process Monitor , still it's a real-time monitor , which can't help me , since my problem happens when windows is booting before I even login I guess .

SaberH said:

... I downloaded the Process Monitor , still it's a real-time monitor , which can't help me , since my problem happens when windows is booting before I even login I guess .

Process Monitor has an option for setting boot-time logging
How To Enable System Boot Time Logging using Process Monitor Tool
but the information you want is going to be buried in a huge amount of data.