HKEY_USERS\.DEFAULT\Control Panel\Desktop
This is the user settings when noone is logged in. This is the user (ie noone) whose screensaver activates at the welcome screen. Query does not write. It is reading only. It is not your setting. Don't confuse it with the Default User. This is a user who never does anything (unlike ..Default)but all created users are based on it (when created).
Your settings are at
HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Control Panel\Desktop
[That number is a user from my computer - your number is different] which are mirrored at
HKEY_CURRENT_USER\Control Panel\Desktop
for the current user (who ever happens to be logged in).
HKEY_CURRENT_USER (a mirror of HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003) and HKEY_CLASSES_ROOT (combined from HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Software\Classesand HKEY_LOCAL_MACHINE\SOFTWARE\Classes) don't actually exist. They show current almagamated settings for the current user. When user and machine setting are the same user normally take precedence.
If you had pro one could remove yourself from being allowed to write to this key. Then the program can't either as it uses your security.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message news
O-dnZiX7OE-JyHenZ2dnUVZ_tWdnZ2d@adelphia.com...
> David Candy wrote:
>
>> It is reading that from the system settings (for when noone is logged
>> on). Seems rather irrelevent as you will not see the window in the
>> first place.
>>
>> 748 is the process ID (easy to get the program's number - much harder
>> [meaning more work] to get it's name). Look in Task Manager process
>> tab. Queryvalue means it is being read only, not written.
>>
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup. What make you think it happens at
>> startup rather than shutdown.
>>
>> Create a new administrator account. Fix FLT to what you want it to
>> be. Log out of your account. Log in to new account. Type regedit in
>> Start Run, read help on loading hives. Load your hive.
>>
>> the new temporary path to your FLT is
>>
>> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>>
>> Has it changed since you logged off.
>>
>> Give auditing a go. Note Read Help carefully. It is a two stage
>> thing. Turn auditing on for Objects. Then set the object (the desktop
>> regkey) to be audited.
>>
>> Also regmon has filters. I would have entered ForegroundLockTimeout
>> as the filter (on edit menu) and if there was only one read I would
>> see only 1 line (not 90 000 of them).
>
>
>
> I think I found the culprit:
>
> 1430443: WinDates.exe:3036 SetValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710
>
>
> WinDates is a calendar app. If I am right, I am going to flogg the
> developer -- at least with a wet noodle.
>
> I did a very low-tech check. When the computer was starting up, I went
> into the registry with regedit several times. At one point, the value
> changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
> was Firefox that was the culprit. However, now, when I ran the login
> function a little longer, I got the line above (1430443).
>
> However, the very first occurence of ForegroundLockTimeout is this:
>
>
> 97006: winlogon.exe:752 QueryValue HKU\.Default\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40
>
> Where in the dickens does the default value 0x30D40 come from? I guess
> that it only shows the default value, but that whatever I have changed
> it to will show up later, e.g.,
>
> 139991: winlogon.exe:752 QueryValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0
>
> So, now I will not start WinDates at startup, and see what happens.
>
> I'll be bakk!
>
> Hans L
>
>
> --
>
>
>
>
>
>