ok here is some stuff from eventid.net
"As per Microsoft: "This problem can occur if a handle to a registry key is not closed correctly."
Several users have reported this problem as occuring after the installation of various software packages.
From a contributor (KG): Change the start type of the service Windows Management Instrumentation to manual and then stop the service, in this way the file winmgmt.exe is not used by the system anymore, unless you manually start it. After that, delete any extra profiles that the computer had created and also make a few changes to "My Desktop" to test wheather these changes would be uploaded. Log off and then on again. The error message in the event viewer should disapear.
According to a user:
"I, and others, are working with MS on this one [..] Have you disabled/stopped any default services? Is your "Documents and Settings" folder in the canonical place. I can reproduce the problem right after a restart by simply starting/stopping the NetMeeting client (CONF.EXE, no connection necessary) and then logging off. I have read about others reproducing it by using Netscape, Office2000, etc... The problem is with two registry files, UsrClass.dat and UsrClass.dat.log (buried in one's profile dir) ... which the system process always has open and which (here at least) never contain any data. They can't be "unloaded" at logoff, and remain open even after another user logs on (hence the two "leaked" handles reported in %SystemRoot%\Debug\UserMode\userenv.log (there you see that the minute delay at logoff is caused by the system trying once per second for a minute to unload those files)."
here are some kb articles
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q253820
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q185198
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q269858
and this site is very usefule
http://www.eventid.net
hope this helps, i believe whats in the second paragraph should help .. good luck ..
-neural
