David Candy wrote:

> It is reading that from the system settings (for when noone is logged
> on). Seems rather irrelevent as you will not see the window in the
> first place.
>
> 748 is the process ID (easy to get the program's number - much harder
> [meaning more work] to get it's name). Look in Task Manager process
> tab. Queryvalue means it is being read only, not written.
>
> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> "ForegroundLockTimeout"
>
> Put above in a shortcut in startup. What make you think it happens at
> startup rather than shutdown.
>
> Create a new administrator account. Fix FLT to what you want it to
> be. Log out of your account. Log in to new account. Type regedit in
> Start Run, read help on loading hives. Load your hive.
>
> the new temporary path to your FLT is
>
> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>
> Has it changed since you logged off.
>
> Give auditing a go. Note Read Help carefully. It is a two stage
> thing. Turn auditing on for Objects. Then set the object (the desktop
> regkey) to be audited.
>
> Also regmon has filters. I would have entered ForegroundLockTimeout
> as the filter (on edit menu) and if there was only one read I would
> see only 1 line (not 90 000 of them).



I think I found the culprit:

1430443: WinDates.exe:3036 SetValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710


WinDates is a calendar app. If I am right, I am going to flogg the
developer -- at least with a wet noodle.

I did a very low-tech check. When the computer was starting up, I went
into the registry with regedit several times. At one point, the value
changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
was Firefox that was the culprit. However, now, when I ran the login
function a little longer, I got the line above (1430443).

However, the very first occurence of ForegroundLockTimeout is this:


97006: winlogon.exe:752 QueryValue HKU\.Default\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40

Where in the dickens does the default value 0x30D40 come from? I guess
that it only shows the default value, but that whatever I have changed
it to will show up later, e.g.,

139991: winlogon.exe:752 QueryValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0

So, now I will not start WinDates at startup, and see what happens.

I'll be bakk!

Hans L


--

Trevor L. wrote:

> Hans L wrote:
> > David, see interspersed comments:
> >
> > David Candy wrote:
> > > cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> > > "ForegroundLockTimeout"
> > >
> > > Put above in a shortcut in startup.
> >
> > I do not understand how to put it in a shortcut in startup.
> > "startup", I assume, is "Startup" in start--All programs--Startup,
> > but how do I put the text above in a shortcut? And what will the
> > result be (what, when, where).
>
> I think this one is fairly straightforward.
>
> Using UltraEdit, create a text file fred.bat (or any name) with
> contents (all on one line, I assume) cmd /k reg query
> "HKEY_CURRENT_USER\Control Panel\Desktop" /v "ForegroundLockTimeout"
>
> Place it in
> C:\Documents and Settings\Hans\Start Menu\Programs\Startup (change
> Hans to your username) or
> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
>
> This should work. Or you could put a shortcut in this location and
> point it to to fred.bat


Thank you, Trevor. I may not need it -- see message I just posted.
But if I do, I now know what to do.

Hans L
--

HKEY_USERS\.DEFAULT\Control Panel\Desktop
This is the user settings when noone is logged in. This is the user (ie noone) whose screensaver activates at the welcome screen. Query does not write. It is reading only. It is not your setting. Don't confuse it with the Default User. This is a user who never does anything (unlike ..Default)but all created users are based on it (when created).

Your settings are at
HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Control Panel\Desktop
[That number is a user from my computer - your number is different] which are mirrored at
HKEY_CURRENT_USER\Control Panel\Desktop
for the current user (who ever happens to be logged in).

HKEY_CURRENT_USER (a mirror of HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003) and HKEY_CLASSES_ROOT (combined from HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Software\Classesand HKEY_LOCAL_MACHINE\SOFTWARE\Classes) don't actually exist. They show current almagamated settings for the current user. When user and machine setting are the same user normally take precedence.

If you had pro one could remove yourself from being allowed to write to this key. Then the program can't either as it uses your security.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message newsO-dnZiX7OE-JyHenZ2dnUVZ_tWdnZ2d@adelphia.com...
> David Candy wrote:
>
>> It is reading that from the system settings (for when noone is logged
>> on). Seems rather irrelevent as you will not see the window in the
>> first place.
>>
>> 748 is the process ID (easy to get the program's number - much harder
>> [meaning more work] to get it's name). Look in Task Manager process
>> tab. Queryvalue means it is being read only, not written.
>>
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup. What make you think it happens at
>> startup rather than shutdown.
>>
>> Create a new administrator account. Fix FLT to what you want it to
>> be. Log out of your account. Log in to new account. Type regedit in
>> Start Run, read help on loading hives. Load your hive.
>>
>> the new temporary path to your FLT is
>>
>> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>>
>> Has it changed since you logged off.
>>
>> Give auditing a go. Note Read Help carefully. It is a two stage
>> thing. Turn auditing on for Objects. Then set the object (the desktop
>> regkey) to be audited.
>>
>> Also regmon has filters. I would have entered ForegroundLockTimeout
>> as the filter (on edit menu) and if there was only one read I would
>> see only 1 line (not 90 000 of them).
>
>
>
> I think I found the culprit:
>
> 1430443: WinDates.exe:3036 SetValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710
>
>
> WinDates is a calendar app. If I am right, I am going to flogg the
> developer -- at least with a wet noodle.
>
> I did a very low-tech check. When the computer was starting up, I went
> into the registry with regedit several times. At one point, the value
> changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
> was Firefox that was the culprit. However, now, when I ran the login
> function a little longer, I got the line above (1430443).
>
> However, the very first occurence of ForegroundLockTimeout is this:
>
>
> 97006: winlogon.exe:752 QueryValue HKU\.Default\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40
>
> Where in the dickens does the default value 0x30D40 come from? I guess
> that it only shows the default value, but that whatever I have changed
> it to will show up later, e.g.,
>
> 139991: winlogon.exe:752 QueryValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0
>
> So, now I will not start WinDates at startup, and see what happens.
>
> I'll be bakk!
>
> Hans L
>
>
> --
>
>
>
>
>
>

Hans L wrote:

> Hello:
>
> I know, I am weird. I want newly opened applications to steal focus.
> I know I am weird, because tons of articles on the web is about how
> not to steal focus, no articles on the opposite. It seems to be a
> cardinal sin to steal focus. Worse than gluttony, equal to pride.
>
> Now, having confessed, I expect you to do the same. You are stealing
> my 0x000000000(0) (in ForegroundLockTimeout) and replacing it with a
> value that makes my apps not steal focus.
>
> First, I thought it was Tweak IU, but I uninstalled it, and my
> ForegroundLockTimeout value still changes.
>
> Admit it, it is you :-)
>
> Okay, maybe it is not you, but would you have any idea what in my XP
> Home Dell Dim XPS T700 (yeah, it is a little old) does change the
> value of ForegroundLockTimeout?
>
> Regards,
>
> Hans L


Mystery solved.

The culprit was indeed WinDates by Rockin' Software. When I went to
the website to 'confront' the developer, here is what I found:

"The WinDates calendar software is no longer available for sale. I
have accepted a position with "xxx" Corporation [I'll be darned if I am
going to advertise his new position], the developer of the online "X"
Calendar service. In order to avoid a conflict of interest, I must
discontinue development and further sale of the WinDates calendar
software.

I apologize for any inconvenience this may have caused ...

Sincerely,
Dan Hickman
Rockin' Software"


And so it ends. I will chuck this app, and find a new one (doesn't
Firefox or Mozilla have one). But it was an interesting investigation,
and I want to thank you all who helped and also encouraged me to work
very close to the limit of my knowledge and skills regarding these
things.

All the best, and have a great 2006!

Hans L

PS. The app only changed the ForegroundLockTimeout the first time I
started it. The second time, when I had set the value to 0 again,
nothing happened.



--

You need to know what I wrote to interpret regmon. It shows the underlying key sometimes.

All HKCR are shown as HKCU\whatever (but mean HKCU\Software\Classes\whatever) and hklkm\whatever (but mean HKLM\Software\Classes\whatever) - they leave out the software\classes part.

HKCU\whatever may be shown somtimes as HKU\long number\whatever.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"David Candy" <.> wrote in message news:uWuDALcEGHA.916@TK2MSFTNGP10.phx.gbl...
HKEY_USERS\.DEFAULT\Control Panel\Desktop
This is the user settings when noone is logged in. This is the user (ie noone) whose screensaver activates at the welcome screen. Query does not write. It is reading only. It is not your setting. Don't confuse it with the Default User. This is a user who never does anything (unlike ..Default)but all created users are based on it (when created).

Your settings are at
HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Control Panel\Desktop
[That number is a user from my computer - your number is different] which are mirrored at
HKEY_CURRENT_USER\Control Panel\Desktop
for the current user (who ever happens to be logged in).

HKEY_CURRENT_USER (a mirror of HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003) and HKEY_CLASSES_ROOT (combined from HKEY_USERS\S-1-5-21-1757981266-1592454029-725345543-1003\Software\Classesand HKEY_LOCAL_MACHINE\SOFTWARE\Classes) don't actually exist. They show current almagamated settings for the current user. When user and machine setting are the same user normally take precedence.

If you had pro one could remove yourself from being allowed to write to this key. Then the program can't either as it uses your security.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message newsO-dnZiX7OE-JyHenZ2dnUVZ_tWdnZ2d@adelphia.com...
> David Candy wrote:
>
>> It is reading that from the system settings (for when noone is logged
>> on). Seems rather irrelevent as you will not see the window in the
>> first place.
>>
>> 748 is the process ID (easy to get the program's number - much harder
>> [meaning more work] to get it's name). Look in Task Manager process
>> tab. Queryvalue means it is being read only, not written.
>>
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup. What make you think it happens at
>> startup rather than shutdown.
>>
>> Create a new administrator account. Fix FLT to what you want it to
>> be. Log out of your account. Log in to new account. Type regedit in
>> Start Run, read help on loading hives. Load your hive.
>>
>> the new temporary path to your FLT is
>>
>> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>>
>> Has it changed since you logged off.
>>
>> Give auditing a go. Note Read Help carefully. It is a two stage
>> thing. Turn auditing on for Objects. Then set the object (the desktop
>> regkey) to be audited.
>>
>> Also regmon has filters. I would have entered ForegroundLockTimeout
>> as the filter (on edit menu) and if there was only one read I would
>> see only 1 line (not 90 000 of them).
>
>
>
> I think I found the culprit:
>
> 1430443: WinDates.exe:3036 SetValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710
>
>
> WinDates is a calendar app. If I am right, I am going to flogg the
> developer -- at least with a wet noodle.
>
> I did a very low-tech check. When the computer was starting up, I went
> into the registry with regedit several times. At one point, the value
> changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
> was Firefox that was the culprit. However, now, when I ran the login
> function a little longer, I got the line above (1430443).
>
> However, the very first occurence of ForegroundLockTimeout is this:
>
>
> 97006: winlogon.exe:752 QueryValue HKU\.Default\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40
>
> Where in the dickens does the default value 0x30D40 come from? I guess
> that it only shows the default value, but that whatever I have changed
> it to will show up later, e.g.,
>
> 139991: winlogon.exe:752 QueryValue HKCU\Control
> Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0
>
> So, now I will not start WinDates at startup, and see what happens.
>
> I'll be bakk!
>
> Hans L
>
>
> --
>
>
>
>
>
>

Type msconfig in Start Run and find WinDates on the startup tab and see if it has a parameter.

If you want to keep using it I can make a program that resets FLT in realtime. But see if it has a parameter that installs it or something in MSConfig.

I don't know why he would set such a thing in his program. He shouldn't be changing it but he is and I can't see any advantage to him in doing so.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message news:gL-dnf1gp7SXXyHenZ2dnUVZ_t6dnZ2d@adelphia.com...
> Hans L wrote:
>
>> Hello:
>>
>> I know, I am weird. I want newly opened applications to steal focus.
>> I know I am weird, because tons of articles on the web is about how
>> not to steal focus, no articles on the opposite. It seems to be a
>> cardinal sin to steal focus. Worse than gluttony, equal to pride.
>>
>> Now, having confessed, I expect you to do the same. You are stealing
>> my 0x000000000(0) (in ForegroundLockTimeout) and replacing it with a
>> value that makes my apps not steal focus.
>>
>> First, I thought it was Tweak IU, but I uninstalled it, and my
>> ForegroundLockTimeout value still changes.
>>
>> Admit it, it is you :-)
>>
>> Okay, maybe it is not you, but would you have any idea what in my XP
>> Home Dell Dim XPS T700 (yeah, it is a little old) does change the
>> value of ForegroundLockTimeout?
>>
>> Regards,
>>
>> Hans L
>
>
> Mystery solved.
>
> The culprit was indeed WinDates by Rockin' Software. When I went to
> the website to 'confront' the developer, here is what I found:
>
> "The WinDates calendar software is no longer available for sale. I
> have accepted a position with "xxx" Corporation [I'll be darned if I am
> going to advertise his new position], the developer of the online "X"
> Calendar service. In order to avoid a conflict of interest, I must
> discontinue development and further sale of the WinDates calendar
> software.
>
> I apologize for any inconvenience this may have caused ...
>
> Sincerely,
> Dan Hickman
> Rockin' Software"
>
>
> And so it ends. I will chuck this app, and find a new one (doesn't
> Firefox or Mozilla have one). But it was an interesting investigation,
> and I want to thank you all who helped and also encouraged me to work
> very close to the limit of my knowledge and skills regarding these
> things.
>
> All the best, and have a great 2006!
>
> Hans L
>
> PS. The app only changed the ForegroundLockTimeout the first time I
> started it. The second time, when I had set the value to 0 again,
> nothing happened.
>
>
>
> --
>

David, see interspersed comments:

David Candy wrote:

> It is reading that from the system settings (for when noone is logged
> on). Seems rather irrelevent as you will not see the window in the
> first place.
>
> 748 is the process ID (easy to get the program's number - much harder
> [meaning more work] to get it's name). Look in Task Manager process
> tab. Queryvalue means it is being read only, not written.

Judging from the use of these numbers, 748 is probably the ID for
winlogon.exe


>
> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> "ForegroundLockTimeout"
>
> Put above in a shortcut in startup.

I do not understand how to put it in a shortcut in startup. "startup",
I assume, is "Startup" in start--All programs--Startup, but how do I
put the text above in a shortcut? And what will the result be (what,
when, where).

What make you think it happens at
> startup rather than shutdown.

Since my last message, I started Windows in Safe Mode, and then, there
was no change of ForegroundLockTimeout [it stayed as 0x00000000(0)]. I
believe that means the change does not take place during closedown.


>
> Create a new administrator account. Fix FLT to what you want it to
> be. Log out of your account. Log in to new account. Type regedit in
> Start Run, read help on loading hives. Load your hive.
>
> the new temporary path to your FLT is
>
> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>
> Has it changed since you logged off.

I'll check this out if the above Safe Mode thing is not proof enough.


>
> Give auditing a go. Note Read Help carefully. It is a two stage
> thing. Turn auditing on for Objects. Then set the object (the desktop
> regkey) to be audited.

Unfortunately, I have XP Home, and the auditing only works in
Professional.

>
> Also regmon has filters. I would have entered ForegroundLockTimeout
> as the filter (on edit menu) and if there was only one read I would
> see only 1 line (not 90 000 of them).

I did that once, but it did not seem to work. However, I think I just
did not find the log file at that point (by "root", the authors of
RegMon means C:\Windows, and thought I looked there too, I missed the
file the first time). I will try with the filter once again, and then
I will also try to run the log through startup and closedown.

By the way, my UltraEdit-32 opens 170 MB without a hitch. And I
learned a little by having the entire file and reading a little
tutorial on the Sysinternal website.

Regards,

Hans L



--

Hans L wrote:
> David, see interspersed comments:
>
> David Candy wrote:
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup.
>
> I do not understand how to put it in a shortcut in startup.
> "startup", I assume, is "Startup" in start--All programs--Startup,
> but how do I put the text above in a shortcut? And what will the
> result be (what, when, where).

I think this one is fairly straightforward.

Using UltraEdit, create a text file fred.bat (or any name) with contents
(all on one line, I assume)
cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
"ForegroundLockTimeout"

Place it in
C:\Documents and Settings\Hans\Start Menu\Programs\Startup (change Hans to
your username)
or
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

This should work. Or you could put a shortcut in this location and point it
to to fred.bat


--
Cheers,
Trevor L.
Website: http://tandcl.homemail.com.au

Ah well, if it doesn't happen in safe mode then type in Help while online,
clean boot troubleshooting.

Have a think - do 1/2 of them, then either the other 1/2 or 1/2 the first 1/2. The difference in effort is logarithmic. The more items the less effort. In programming terms it is known as QuickSearch.

If 16 items then one at a time is an average of 8 boots, minimun 1 and a max of 16. Using Quick alogarithm the max is 4 reboots (the average is a little under 4). Or 25%. If 32 items the max is 32 one at a time or 5 with Quick (about 17%). I hate rebooting.

That PID is winlogon. Regmon shows name and PID.

To create a shortcut r/c desktop, New - Shortcut and put it in the Wizard. Drag shortcut to startup. Do this anyway for interest sake. It will pop up a window with the registry value of FLT (type it in start run to see what it looks like). I'd put Regmon there too. It may be being changed after Regmon finishes logging the boot. Don't put a filter or regmon will ask you to confirm it (you want it to be logging straight away not asking you questions).

I presume they use the Edit control (like notepad) or the Rich Text control (like Wordpad) which is a 4 gb max file size.
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Hans L" <fakeascanbe@evenfakier.com> wrote in message news:BbydnVJ4j6uoLSHenZ2dnUVZ_v6dnZ2d@adelphia.com ...
> David, see interspersed comments:
>
> David Candy wrote:
>
>> It is reading that from the system settings (for when noone is logged
>> on). Seems rather irrelevent as you will not see the window in the
>> first place.
>>
>> 748 is the process ID (easy to get the program's number - much harder
>> [meaning more work] to get it's name). Look in Task Manager process
>> tab. Queryvalue means it is being read only, not written.
>
> Judging from the use of these numbers, 748 is probably the ID for
> winlogon.exe
>
>
>>
>> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
>> "ForegroundLockTimeout"
>>
>> Put above in a shortcut in startup.
>
> I do not understand how to put it in a shortcut in startup. "startup",
> I assume, is "Startup" in start--All programs--Startup, but how do I
> put the text above in a shortcut? And what will the result be (what,
> when, where).
>
> What make you think it happens at
>> startup rather than shutdown.
>
> Since my last message, I started Windows in Safe Mode, and then, there
> was no change of ForegroundLockTimeout [it stayed as 0x00000000(0)]. I
> believe that means the change does not take place during closedown.
>
>
>>
>> Create a new administrator account. Fix FLT to what you want it to
>> be. Log out of your account. Log in to new account. Type regedit in
>> Start Run, read help on loading hives. Load your hive.
>>
>> the new temporary path to your FLT is
>>
>> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>>
>> Has it changed since you logged off.
>
> I'll check this out if the above Safe Mode thing is not proof enough.
>
>
>>
>> Give auditing a go. Note Read Help carefully. It is a two stage
>> thing. Turn auditing on for Objects. Then set the object (the desktop
>> regkey) to be audited.
>
> Unfortunately, I have XP Home, and the auditing only works in
> Professional.
>
>>
>> Also regmon has filters. I would have entered ForegroundLockTimeout
>> as the filter (on edit menu) and if there was only one read I would
>> see only 1 line (not 90 000 of them).
>
> I did that once, but it did not seem to work. However, I think I just
> did not find the log file at that point (by "root", the authors of
> RegMon means C:\Windows, and thought I looked there too, I missed the
> file the first time). I will try with the filter once again, and then
> I will also try to run the log through startup and closedown.
>
> By the way, my UltraEdit-32 opens 170 MB without a hitch. And I
> learned a little by having the entire file and reading a little
> tutorial on the Sysinternal website.
>
> Regards,
>
> Hans L
>
>
>
> --
>

David Candy wrote:

> It is reading that from the system settings (for when noone is logged
> on). Seems rather irrelevent as you will not see the window in the
> first place.
>
> 748 is the process ID (easy to get the program's number - much harder
> [meaning more work] to get it's name). Look in Task Manager process
> tab. Queryvalue means it is being read only, not written.
>
> cmd /k reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v
> "ForegroundLockTimeout"
>
> Put above in a shortcut in startup. What make you think it happens at
> startup rather than shutdown.
>
> Create a new administrator account. Fix FLT to what you want it to
> be. Log out of your account. Log in to new account. Type regedit in
> Start Run, read help on loading hives. Load your hive.
>
> the new temporary path to your FLT is
>
> HKU\<the name you chose when loading the hive>\Control Panel\Desktop
>
> Has it changed since you logged off.
>
> Give auditing a go. Note Read Help carefully. It is a two stage
> thing. Turn auditing on for Objects. Then set the object (the desktop
> regkey) to be audited.
>
> Also regmon has filters. I would have entered ForegroundLockTimeout
> as the filter (on edit menu) and if there was only one read I would
> see only 1 line (not 90 000 of them).



I think I found the culprit:

1430443: WinDates.exe:3036 SetValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x2710


WinDates is a calendar app. If I am right, I am going to flogg the
developer -- at least with a wet noodle.

I did a very low-tech check. When the computer was starting up, I went
into the registry with regedit several times. At one point, the value
changes from 0x00000000(0) to 0x00002710(10000), and it looked as if it
was Firefox that was the culprit. However, now, when I ran the login
function a little longer, I got the line above (1430443).

However, the very first occurence of ForegroundLockTimeout is this:


97006: winlogon.exe:752 QueryValue HKU\.Default\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x30D40

Where in the dickens does the default value 0x30D40 come from? I guess
that it only shows the default value, but that whatever I have changed
it to will show up later, e.g.,

139991: winlogon.exe:752 QueryValue HKCU\Control
Panel\Desktop\ForegroundLockTimeout SUCCESS 0x0

So, now I will not start WinDates at startup, and see what happens.

I'll be bakk!

Hans L


--