Random Windows Shutdown Failures

[larrybody]

My mother has called me to troubleshoot her WindowsXP Pro SP2 machine's inability to shut down properly. I have checked event viewer for error messages and have concluded that the problem is when Windows attempts to unload her user profile and the users section of the registry it fails because an unknown program was referencing the users section of the registry. This locks the profile and the registry cannot unload profiles that are locked and in use. I can always manually shut down her computer by pressing CtrlAltDelete and then holding down the Ctrl key while clicking on shutdown. This reboots the computer, releasing the offending program from accesing the registry, and then I can shut down the computer normally. Too many hoops for my mother to jump thru. How do I identify the offending program? There might be a error message flashed about closing a program, but the issue is random and I cannot recreate the problem. What utility can I use to find the program that is referencing the registry and causing the problem?