Hi,
Session Manager typically launches Chkdsk (autocheck.exe), which is
specified in the Session Manager's BootExecute value along with direction to
run other boot-time native applications. After Autocheck finishes Session
Manager starts Winlogon and the Win32 subsystem (CSRSS.EXE). Both of these
generate interleaved Registry accesses as they start up concurrently.
Winlogon can be seen querying the .Default key's display settings, including
colors and mouse settings under HKU\.Default\Control Panel. The .Default
key's contents are user preferences that are active when no one is logged
in, and Winlogon uses them for the screen on which it displays the logon
dialog box.
More info here:
http://www.sysinternals.com/Information/BootTimeRegistryActivity.html
Make note: The log files have a finite size, and the system overwrites
events according to the log's configuration options. Changes you make to the
configuration settings depend on your situation.
Suggestion:
Event Log Explorer (Line 375)
http://www.kellys-korner-xp.com/xp_tweaks.htm
Added info:
If Event Viewer reports on startup that one or more of your log files is
corrupt, you can remedy the situation as follows:
Disable the Event Log service by going to Start/Run: services.msc
Once done, restart Windows.
Delete the corrupt log(s)-Appevent.evt, Secevent.evt, and/or
Sysevent.evt-from %SystemRoot%\System32\Config (or wherever they may be).
Your existing event data will be lost, but a new log file will be created
when the service is restarted, and that log will start to accumulate new
events.
Reenable the Event Log service, and start the service.
If the Event Log service doesn't restart successfully, then restart Windows
XP.
Note: You cannot delete or rename the log files while the Event Log service
is running.
--
All the Best,
Kelly (MS-MVP)
Troubleshooting Windows XP
http://www.kellys-korner-xp.com
In memory of those lost during Katrina &
Prayers and Hope for the remaining displaced.