Ah well, if it doesn't happen in safe mode then type in Help while online,
clean boot troubleshooting.

Have a think - do 1/2 of them, then either the other 1/2 or 1/2 the first 1/2. The difference in effort is logarithmic. The more items the less effort. In programming terms it is known as QuickSearch.

If 16 items then one at a time is an average of 8 boots, minimun 1 and a max of 16. Using Quick alogarithm the max is 4 reboots (the average is a little under 4). Or 25%. If 32 items the max is 32 one at a time or 5 with Quick (about 17%). I hate rebooting.

That PID is winlogon. Regmon shows name and PID.

To create a shortcut r/c desktop, New - Shortcut and put it in the Wizard. Drag shortcut to startup. Do this anyway for interest sake. It will pop up a window with the registry value of FLT (type it in start run to see what it looks like). I'd put Regmon there too. It may be being changed after Regmon finishes logging the boot. Don't put a filter or regmon will ask you to confirm it (you want it to be logging straight away not asking you questions).

I presume they use the Edit control (like notepad) or the Rich Text control (like Wordpad) which is a 4 gb max file size.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message news:BbydnVJ4j6uoLSHenZ2dnUVZ_v6dnZ2d@adelphia.com ...
> David, see interspersed comments:
>
> David Candy wrote:
>
>> It is reading that from the system settings (for when noone is logged
>> on). Seems rather irrelevent as you will not see the window in the
>> first place.
>>
>> 748 is the process ID (easy to get the program's number - much harder
>> [meaning more work] to get it's name). Look in Task Manager process
>> tab. Queryvalue means it is being read only, not written.
>
> Judging from the use of these numbers, 748 is probably the ID for
> winlogon.exe
>
>
>>
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup.
>
> I do not understand how to put it in a shortcut in startup. "startup",
> I assume, is "Startup" in start--All programs--Startup, but how do I
> put the text above in a shortcut? And what will the result be (what,
> when, where).
>
> What make you think it happens at
>> startup rather than shutdown.
>
> Since my last message, I started Windows in Safe Mode, and then, there
> was no change of ForegroundLockTimeout [it stayed as 0x00000000(0)]. I
> believe that means the change does not take place during closedown.
>
>
>>
>> Create a new administrator account. Fix FLT to what you want it to
>> be. Log out of your account. Log in to new account. Type regedit in
>> Start Run, read help on loading hives. Load your hive.
>>
>> the new temporary path to your FLT is
>>
>> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>>
>> Has it changed since you logged off.
>
> I'll check this out if the above Safe Mode thing is not proof enough.
>
>
>>
>> Give auditing a go. Note Read Help carefully. It is a two stage
>> thing. Turn auditing on for Objects. Then set the object (the desktop
>> regkey) to be audited.
>
> Unfortunately, I have XP Home, and the auditing only works in
> Professional.
>
>>
>> Also regmon has filters. I would have entered ForegroundLockTimeout
>> as the filter (on edit menu) and if there was only one read I would
>> see only 1 line (not 90 000 of them).
>
> I did that once, but it did not seem to work. However, I think I just
> did not find the log file at that point (by "root", the authors of
> RegMon means C:\Windows, and thought I looked there too, I missed the
> file the first time). I will try with the filter once again, and then
> I will also try to run the log through startup and closedown.
>
> By the way, my UltraEdit-32 opens 170 MB without a hitch. And I
> learned a little by having the entire file and reading a little
> tutorial on the Sysinternal website.
>
> Regards,
>
> Hans L
>
>
>
> --
>