On Windows 2000 the service deals with application event log event 1000 from source Userenv where the message indicates that the profile is not unloading and the error is "Access is denied". On Windows XP and Windows 2003 the equivalent events are 1517 and 1524 from source Userenv.
To accomplish this the service monitors for logged off users that still have hives loaded. When that happens the service determines which applications ha （全文共1979字）——点击
此处阅读全文