You can set the Windows XP Registry Debug Mode value to log everything when
the system boots (Drivers, profiles, ....) and read the log after it
finishes.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Create a DWORD named UserEnvDebugLevel and set the value to 0x30002 (hex)
The log file is created under: C:\Windows\Debug\UserMode\Userenv.log
It will contain (example):
USERENV(220.224) 10:39:55:934 InitializePolicyProcessing: Initialised
Machine Mutex/Events
USERENV(220.224) 10:39:55:974 InitializePolicyProcessing: Initialised User
Mutex/Events
USERENV(220.224) 10:39:55:974 LibMain: Process Name:
\??\C:\WINXP\system32\winlogon.exe
USERENV(220.224) 10:39:57:045 Entering CUserProfile::Initialize ...
USERENV(220.224) 10:39:57:055 CUserProfile::Initialize called by winlogon
USERENV(220.224) 10:39:57:055 CUserProfile::Initialize: critical section
initialized
USERENV(220.224) 10:39:57:055 CSyncManager::Initialize: critical section
initialized
USERENV(220.224) 10:39:57:065 CUserProfile::Initialize: registry key
Software\Microsoft\Windows NT\CurrentVersion\ProfileList opened
USERENV(220.224) 10:39:57:065 CUserProfile::Initialize: Proccessing
S-1-5-21-1390067357-1606980848-1060284298-1006
USERENV(220.224) 10:39:57:065 CSyncManager::EnterLock
<S-1-5-21-1390067357-1606980848-1060284298-1006>
USERENV(220.224) 10:39:57:065 CSyncManager::EnterLock: No existing entry
found
USERENV(220.224) 10:39:57:075 CSyncManager::EnterLock: New entry created
USERENV(220.224) 10:39:57:075 CHashTable::HashAdd:
S-1-5-21-1390067357-1606980848-1060284298-1006 added in bucket 0
USERENV(220.224) 10:39:57:075 CUserProfile::CleanupUserProfile: Enter
critical section.
USERENV(220.224) 10:39:57:085 CUserProfile::GetRefCountAndFlags: Ref count
is 0, state is 00000104
USERENV(220.224) 10:39:57:085 CSyncManager::LeaveLock
<S-1-5-21-1390067357-1606980848-1060284298-1006>
USERENV(220.224) 10:39:57:085 CSyncManager::LeaveLock: Lock released
USERENV(220.224) 10:39:57:095 CHashTable::HashDelete:
S-1-5-21-1390067357-1606980848-1060284298-1006 deleted
USERENV(220.224) 10:39:57:095 CSyncManager::LeaveLock: Lock deleted
USERENV(220.224) 10:39:57:095 CUserProfile::CleanupUserProfile: Leave
critical section
USERENV(220.224) 10:39:57:095 CUserProfile::Initialize: Proccessing
S-1-5-21-1390067357-1606980848-1060284298-1004
USERENV(220.224) 10:39:57:105 CSyncManager::EnterLock
<S-1-5-21-1390067357-1606980848-1060284298-1004>
USERENV(220.224) 10:39:57:105 CSyncManager::EnterLock: No existing entry
found
USERENV(220.224) 10:39:57:105 CSyncManager::EnterLock: New entry created
USERENV(220.224) 10:39:57:115 CHashTable::HashAdd:
S-1-5-21-1390067357-1606980848-1060284298-1004 added in bucket 21
USERENV(220.224) 10:39:57:115 CUserProfile::CleanupUserProfile: Enter
critical section.
USERENV(220.224) 10:39:57:115 CUserProfile::GetRefCountAndFlags: Ref count
is 0, state is 00000104
USERENV(220.224) 10:39:57:115 CSyncManager::LeaveLock
<S-1-5-21-1390067357-1606980848-1060284298-1004>
USERENV(220.224) 10:39:57:125 CSyncManager::LeaveLock: Lock released
USERENV(220.224) 10:39:57:125 CHashTable::HashDelete:
S-1-5-21-1390067357-1606980848-1060284298-1004 deleted
USERENV(220.224) 10:39:57:125 CSyncManager::LeaveLock: Lock deleted
USERENV(220.224) 10:39:57:135 CUserProfile::CleanupUserProfile: Leave
critical section
USERENV(220.224) 10:39:57:135 CUserProfile::Initialize: Proccessing
S-1-5-21-1390067357-1606980848-1060284298-1003
Remember to rename the Registry key (so you can use it later again), so that
Windows XP doesn't continually log.