system32 folder

From: Nay (anonymous_at_discussions.microsoft.com)
Date: 09/07/04


Date: Mon, 6 Sep 2004 21:59:01 -0700

I know it may look obvious, but did you check both the
Startup folder for the Default User and the Run/RunOnce
keys for the HKEY_USERS\.DEFAULT\... etc.

You can, alternatively, take snapshots of all processes
that run from the moment a user hits OK at logon until
they get the desktop. Logon as an admin and make a batch
file with this in it:

:SNAPSHOT
qprocess %USERNAME%>>LOGFILE.LOG
SLEEP 1
GOTO SNAPSHOT
 
where %USERNAME% is the user that is logging on for the
first time (you will need the sleep.exe utility from the
resource kit). If the 1 second sleep time is too large
for you you may want to take that line out to get a more
verbose output, just keep in mind that it will probably
suck all your CPU out until you manually kill the batch
file, since it will loop.

Nay

>-----Original Message-----
>I have a terminal server that is opening up the system32
folder at login.
>
>It only does this the first time the user logs in. The
next time the user
>logs in the system32 doesnot open.
>
>I've checked run, run once in both HKLM and HKCU.
Neither have any entries
>with system32, spaces, or "". I've also searched through
the registry for
>system32 entries with errors in the path and also came
with nothing.
>
>Also tried turning debugging on. I'm not seeing anything
is the userenv.log
>that looks to be linked to the problem.
>
>Does anyone know of way to log every process that takes
place when a user
>logs on. Or does someone know of anyway to fix this
problem.
>
>Thanks.
>.
>



Relevant Pages

  • system32 folder
    ... I have a terminal server that is opening up the system32 folder at login. ... It only does this the first time the user logs in. ... system32 entries with errors in the path and also came with nothing. ...
    (microsoft.public.win2000.termserv.apps)
  • Re: [incident] IIS defacement through FTP, possible DoS
    ... that this isn't the first time I've seen more than just scripts coming ... Was wondering if anyone is aware of an IIS FTP server exploit that allows ... Checking the FTP logs, which is the site's owner's only way in, I see the ... For more information on this free incident handling, ...
    (Incidents)
  • Re: How?
    ... This is a SQL Server newsgroup. ... >Set Time1= currentrecord.time ... >>It logs the time when the user goes on the internet, ... >>the first time i have logged for them is at 8am and the last time i have ...
    (microsoft.public.sqlserver.programming)
  • Re: XP erasing files in personal shares
    ... the directory structure is intact but no files in ... XP station was prepared, according to 315773. ... the problem happens just this first time he logs off ...
    (microsoft.public.backoffice.smallbiz)
  • Re: XP erasing files in personal shares
    ... the directory structure is intact but no files ... XP station was prepared, according to 315773. ... the problem happens just this first time ... >> he logs off XP, subsequent log offs will not affect any files. ...
    (microsoft.public.backoffice.smallbiz)