the quote below is from a file called userenv.log located in my c:\windows\debug\usermode folder. the words Impersonating user sounds a bit strange. anyone know how to find this Impersonating user?
UnloadUserProfileP: Didn't unload user profile <err = 5>
USERENV(180.184) 02:31:17:203 MyRegUnLoadKey: Failed to unmount hive 00000005
USERENV(180.184) 02:31:17:203 UnLoadClassHive: failed to unload classes key with 5
USERENV(180.184) 02:31:17:203 DumpOpenRegistryHandle: 2 user registry Handles leaked from \Registry\User\S-1-5-21-1343024091-688789844-839522115-1003_Classes
USERENV(180.184) 02:31:17:203 ReportError: Impersonating user.
USERENV(180.184) 02:34:57:562 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(180.184) 02:34:57:578 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(180.184) 02:34:57:578 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(180.184) 02:41:10:796 MyRegUnLoadKey: Failed to unmount hive 00000005
I may be a bit dusty but I think it's a thing that allows a program running under one name to use another user's credidentials (sp). I think I've used it once but I can't really remember.