I have 4 Windows 2003 servers 2 DC's Windows 2003 R2 Standard SP2 1 Windows 2003 R2 Standard Stand Alone, 4th one is Windows 2003 R2 Enterprise 64bit I run this cmd file at startup on all 4 servers @echo off c:\util\pstools\bginfo c:\util\bginfo.bgi /all /timer:0 /silent RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters exit the only event log item that appears is this Type : Warning Date : 9/23/2011 Time : 2:04:00 PM Event : 3004 Source : WinDefend Category : None User : N/A Computer : TGCS005 Description: Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=74409 Scan ID: {7713B1CE-C082-49C1-9696-CBBF63A09EF3} User: OUR\administrator Name: Unknown ID: Severity: Not Yet Classified Category: Not Yet Classified Path Found: service:BGInfo Alert Type: Unclassified software Detection Type: bginfo from systeminternals updates the wallpaper with system information On the 3 32bit versions of Windows 2003 servers the wallpaper changes everytime I restart the rundll32 is what changes the wallpaper the bginfo gathers the information about the system. any ideas on why this does not work on my 64bit server. On the 64bit version it does not I have to run the program manually after a restartThomas R Grassi Jr

This is because you have got Windows Defender running on the server which is stop the start up file suspecting it be virus so please exclude the file or else to find the root cause you may disable the Windows Defender and give a tryhttp://www.virmansec.com/blogs/skhairuddin

Thank you I disabled Defender then ran the cmd file and this time the event messages did not appear in the event log. The wallpaper still did not update is the rundll32 line correct for a 64 bit machine? As far as defender goes how do you exclude a program from being monitored in defender? I see how to exclude it from being scanned but that is not the issue It only gives the event message when the program executes Any thoughts on the above? Thanks again TomThomas R Grassi Jr