How to observe made Windows System Changes by a Program

Question

I just came up with a Question thats bugging me. I would like to create or find a Program that can observe filesystem changes and registry etc. Changes made by another Executable. Like Starting a Program through Another and observing the windows api calls or something.

Is that possible? And how would I go about it?

Thanks in advance.

Answer 1

You can use this api http://msdn.microsoft.com/en-us/library/windows/desktop/aa365261(v=vs.85).aspx This api is limited and if your task is out of scope of this api you must go in minifilter driver wonderland.