Windows Registry transaction log - is it always used?

Question

I've read here, here and elsewhere that Windows can use a transaction log when writing to the Windows Registry, and this can be used for forensics.

I'm aware of RegNotifyChangeKeyValue and WMI, but I'm curious if the transaction log could also provide an alternative means for real-time monitoring of Registry changes.

My question, is the transaction log always used? The articles I've found tend to say thing like it "can" use it, but not if it has to.

Answer 1

The transaction log is not always used, a conclusion based on the following data.

On my computer, these are the *.dat.log* files in C:\Windows:

You can see that the only file that was updated today was migration.dat (which doesn't seem like being a registry hive).

Given that some registry hives are updated continuously, it seems that there is no systematic logging being done on my computer. Hence my above conclusion.