It is reading that from the system settings (for when noone is logged on). Seems rather irrelevent as you will not see the window in the first place.

748 is the process ID (easy to get the program's number - much harder [meaning more work] to get it's name). Look in Task Manager process tab. Queryvalue means it is being read only, not written.

cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v "ForegroundLockTimeout"

Put above in a shortcut in startup. What make you think it happens at startup rather than shutdown.

Create a new administrator account. Fix FLT to what you want it to be. Log out of your account. Log in to new account. Type regedit in Start Run, read help on loading hives. Load your hive.

the new temporary path to your FLT is

HKU\<the name you chose when loading the hive>\Control Panel\Desktop

Has it changed since you logged off.

Give auditing a go. Note Read Help carefully. It is a two stage thing. Turn auditing on for Objects. Then set the object (the desktop regkey) to be audited.

Also regmon has filters. I would have entered ForegroundLockTimeout as the filter (on edit menu) and if there was only one read I would see only 1 line (not 90 000 of them).
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message news:EbSdnTlgnJgzEyHeRVn-tQ@adelphia.com...
> Hans L wrote:
>
>> Hans L wrote:
>>
>> > Hello:
>> >
>> > I know, I am weird. I want newly opened applications to steal
>> > focus. I know I am weird, because tons of articles on the web is
>> > about how not to steal focus, no articles on the opposite. It seems
>> > to be a cardinal sin to steal focus. Worse than gluttony, equal to
>> > pride.
>> >
>> > Now, having confessed, I expect you to do the same. You are
>> > stealing my 0x000000000(0) (in ForegroundLockTimeout) and replacing
>> > it with a value that makes my apps not steal focus.
>> >
>> > First, I thought it was Tweak IU, but I uninstalled it, and my
>> > ForegroundLockTimeout value still changes.
>> >
>> > Admit it, it is you :-)
>> >
>> > Okay, maybe it is not you, but would you have any idea what in my XP
>> > Home Dell Dim XPS T700 (yeah, it is a little old) does change the
>> > value of ForegroundLockTimeout?
>> >
>> > Regards,
>> >
>> > Hans L
>
>
>
> David & Mungo:
>
> I set HKEY_CURRENT_USER\Control Panel\Desktop\ForegroundLockTimeout to
> 0x000000000(0).
>
> I set RegMon to log startup changes to the registry.
>
> I got this (and only this) from the log file:
>
>
> 96988: winlogon.exe:748 QueryValue HKU\.Default\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40
>
>
> I cannot interpret this other than to say that 0x30D40 is the hex
> default value for Foreground LockTimeout (200000 ms). However, my
> value after startup was (and is always) 0x00002710(10000).
>
> Is it winlogon.exe that sets this value at startup? 96988 is the line
> number in the RegMon log file. But what is 748 and QueryValue?
>
> And, more importantly, what can I do about this?
>
> Regards,
>
> Hans L
>
>
>
> --
>