"Registry editing has been disabled by administrator" keeps popping up

[Roger]

Hi all
I´m working in a network with app. 400 clients and have had an Group
Policy applyed for some time, meaning that users are not allowed to
run regedit tools.

But all of a sudden, it appears that nearly 10 of the clients get the
message:
"Registry editing has been disabled by administrator" . It has never
shown before, and i wonder why it keeps popping up now.
I don´t want this message to appear at the users computers.
I´ve tried to delete the userprofiles, but it keeps popping up at
logon.
Nothing in the event wiever!

I have temporarily disabled the policy for now to get time to solve
the problem.

Any suggestions?

 

[Doug Knox MS-MVP]

You need to examine the startup vectors to see what's trying to modify the Registry. This behavior is indicative of a virus or other malware infection.

See www.dougknox.com, Win XP Utilities, Startup Programs Tracker. This utility gives a more readable listing than MSCONFIG.