Scheduled Task trigger off of registry key change, ShadowPlay Automation

Software & Operating Systems Windows
,
1

To start off I’m fed up with NV ShadowPlay Instant Replay not working correctly. As in it does not always detect games and or detects other programs like Plex as being a game. If I set the capture privacy to off and enable and disable it manually it seems to just capture the entire display. Nice! However, it also prevents the system from sleeping… Not Nice… I think I have found a way to automate enabling and disabling ShadowPlay at least the VAST majority of my games (there on Steam) by looking at a registry key. I have already made a batch file that can check the status of this key, another registry key that is the status of Shadowplay, and a way to toggle it on and off via the F15 key. But I can not seem to figure out how to make a scheduled task trigger if a certain registry key value changes…

So how do I make a Scheduled Task that triggers when a certain Registry Key Value changes? Namely: HKEY_CURRENT_USER\SOFTWARE\Valve\Steam RunningAppID

I’m assuming I will have to enable Auditing of the registry in local policies but can not find it. I also do not know what the filtering in the event viewer and thus the task scheduler would be.

Here are the contents of my little script I made if curious;

reg query "HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS" /v {1B1D3DAA-601D-49E5-8508-81736CA28C6D} |find /i "00000000" >nul
if errorlevel 1 (set ShadowPlay=1) else (set ShadowPlay=0)
reg query "HKEY_CURRENT_USER\SOFTWARE\Valve\Steam" /v RunningAppID |find /i "0x0" >nul
if errorlevel 1 (set Steam=1) else (set Steam=0)
if %Shadowplay%==%Steam% (exit)
echo >script.vbs set shell = CreateObject("WScript.Shell"):shell.SendKeys "{F15}" & script.vbs
2

Ok so I figured it out I think, at least to a working state.

A Local Security Policy must be enabled. The Policy can be found under “Local Policies” in “Audit Policy” and the Policy “Audit Object Access” must have “Success” enabled. Also in the Registry the key “HKEY_CURRENT_USER\SOFTWARE\Valve\Steam” must have it’s advanced permissions edited to allow auditing Read and advanced Set Value for Everyone.

Then the event XML is;

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4657)]] and *[EventData[Data='RunningAppID']]</Select>
  </Query>
</QueryList>