David Candy wrote:

> It is reading that from the system settings (for when noone is logged
> on). Seems rather irrelevent as you will not see the window in the
> first place.
>
> 748 is the process ID (easy to get the program's number - much harder
> [meaning more work] to get it's name). Look in Task Manager process
> tab. Queryvalue means it is being read only, not written.
>
> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> "ForegroundLockTimeout"
>
> Put above in a shortcut in startup. What make you think it happens at
> startup rather than shutdown.
>
> Create a new administrator account. Fix FLT to what you want it to
> be. Log out of your account. Log in to new account. Type regedit in
> Start Run, read help on loading hives. Load your hive.
>
> the new temporary path to your FLT is
>
> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>
> Has it changed since you logged off.
>
> Give auditing a go. Note Read Help carefully. It is a two stage
> thing. Turn auditing on for Objects. Then set the object (the desktop
> regkey) to be audited.
>
> Also regmon has filters. I would have entered ForegroundLockTimeout
> as the filter (on edit menu) and if there was only one read I would
> see only 1 line (not 90 000 of them).



I think I found the culprit:

1430443: WinDates.exe:3036 SetValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710


WinDates is a calendar app. If I am right, I am going to flogg the
developer -- at least with a wet noodle.

I did a very low-tech check. When the computer was starting up, I went
into the registry with regedit several times. At one point, the value
changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
was Firefox that was the culprit. However, now, when I ran the login
function a little longer, I got the line above (1430443).

However, the very first occurence of ForegroundLockTimeout is this:


97006: winlogon.exe:752 QueryValue HKU\.Default\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40

Where in the dickens does the default value 0x30D40 come from? I guess
that it only shows the default value, but that whatever I have changed
it to will show up later, e.g.,

139991: winlogon.exe:752 QueryValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0

So, now I will not start WinDates at startup, and see what happens.

I'll be bakk!

Hans L


--