Andy,
Yes, those are two SymWise articles that I have read and picked over, over and over. Nice try.
I like your idea of using RegMon, however?!
I do get annoyed that it is a useful thing to be able to do, but Symantec do not publish it. Even if they say, at the same time, "You can do this, but it is unsupported"!
Kindest regards,
QuietLeni