I am using snapshot to see what a program changes in the registry, routine
stuff. But when run the snapshot, all I seem to get 1000's of keys
deleted in HKey_local_machine, not my changes.

I ran it without being logged into the LAN and as admin. Any ideas?

The machine is XPsp2.
Phil J