strComputer = "." 
strHive = "HKEY_LOCAL_MACHINE"
strKeyPath = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\"
strValueName = "Userinit"
'====================================================================
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\DEFAULT") 
Set objEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM RegistryValueChangeEvent WHERE " & _
    "Hive = '" & strHive & "'" & _
    " AND KeyPath = '" & strKeyPath & "'" & _
    " AND ValueName = '" & strValueName & "'")

Do While(True)
    Set objReceivedEvent = objEvents.NextEvent
    Wscript.Echo Now & " изменён ключ: " & strHive & "\" & Replace(strKeyPath, "\\", "\") & strValueName
Loop