Use regmon in https://technet.microsoft.com/en-us/sysinternals/bb896645, and lock down the box :).