It seems to me that doing string comparisons against registry object strings (retrieved via ObQueryNameString) is an inefficient way to filter registry requests just given the large volume of activity that occurs. I’m curious if there are numeric ID values associated with the registry objects (kind of like NTFS file ids) that can be used instead of the name string. If there are, then I could just query and cache the keys I’m interested in and do a numeric comparison vice a string one assuming that the ID values stay consistent. Do they exist and if so, how can I get the value?