David, see interspersed comments:

David Candy wrote:

> It is reading that from the system settings (for when noone is logged
> on). Seems rather irrelevent as you will not see the window in the
> first place.
>
> 748 is the process ID (easy to get the program's number - much harder
> [meaning more work] to get it's name). Look in Task Manager process
> tab. Queryvalue means it is being read only, not written.

Judging from the use of these numbers, 748 is probably the ID for
winlogon.exe


>
> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> "ForegroundLockTimeout"
>
> Put above in a shortcut in startup.

I do not understand how to put it in a shortcut in startup. "startup",
I assume, is "Startup" in start--All programs--Startup, but how do I
put the text above in a shortcut? And what will the result be (what,
when, where).

What make you think it happens at
> startup rather than shutdown.

Since my last message, I started Windows in Safe Mode, and then, there
was no change of ForegroundLockTimeout [it stayed as 0x00000000(0)]. I
believe that means the change does not take place during closedown.


>
> Create a new administrator account. Fix FLT to what you want it to
> be. Log out of your account. Log in to new account. Type regedit in
> Start Run, read help on loading hives. Load your hive.
>
> the new temporary path to your FLT is
>
> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>
> Has it changed since you logged off.

I'll check this out if the above Safe Mode thing is not proof enough.


>
> Give auditing a go. Note Read Help carefully. It is a two stage
> thing. Turn auditing on for Objects. Then set the object (the desktop
> regkey) to be audited.

Unfortunately, I have XP Home, and the auditing only works in
Professional.

>
> Also regmon has filters. I would have entered ForegroundLockTimeout
> as the filter (on edit menu) and if there was only one read I would
> see only 1 line (not 90 000 of them).

I did that once, but it did not seem to work. However, I think I just
did not find the log file at that point (by "root", the authors of
RegMon means C:\Windows, and thought I looked there too, I missed the
file the first time). I will try with the filter once again, and then
I will also try to run the log through startup and closedown.

By the way, my UltraEdit-32 opens 170 MB without a hitch. And I
learned a little by having the entire file and reading a little
tutorial on the Sysinternal website.

Regards,

Hans L



--