Can I make changes to the EventSentry configuration in the registry? Do I have to restart the agent after I made configuration changes?

Yes, you can make changes directly to the registry, but always make a configuration backup before you make any changes to the registry. Please also note that editing the registry directly is not supported.

To make sure that the EventSentry agent picks up the configuration changes you made, create the following empty file when you are done editing the registry:

%SYSTEMROOT%\eventsentry_svc.reg

You should see an information event in the application event log with an event id of 1035 shortly after you created the file. The file will be automatically deleted.