system32 folder

[Guest]

I have a terminal server that is opening up the system32 folder at login.

It only does this the first time the user logs in. The next time the user
logs in the system32 doesnot open.

I've checked run, run once in both HKLM and HKCU. Neither have any entries
with system32, spaces, or "". I've also searched through the registry for
system32 entries with errors in the path and also came with nothing.

Also tried turning debugging on. I'm not seeing anything is the userenv.log
that looks to be linked to the problem.

Does anyone know of way to log every process that takes place when a user
logs on. Or does someone know of anyway to fix this problem.

Thanks.

 

[Nay]

I know it may look obvious, but did you check both the
Startup folder for the Default User and the Run/RunOnce
keys for the HKEY_USERS\.DEFAULT\... etc.

You can, alternatively, take snapshots of all processes
that run from the moment a user hits OK at logon until
they get the desktop. Logon as an admin and make a batch
file with this in it:

:SNAPSHOT
qprocess %USERNAME%>>LOGFILE.LOG
SLEEP 1
GOTO SNAPSHOT

where %USERNAME% is the user that is logging on for the
first time (you will need the sleep.exe utility from the
resource kit). If the 1 second sleep time is too large
for you you may want to take that line out to get a more
verbose output, just keep in mind that it will probably
suck all your CPU out until you manually kill the batch
file, since it will loop.

Nay