I use O&O Defrag Pro which allows boot-time defragging. To achieve this it adds "OODBS" as a new line in the BootExecute value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute However, I had a system crash and now my system always does a boot-time defrag, even when I've disabled it from the GUI. To stop this happening I removed the "OODBS" line from the BootExecute value. When I rebooted, it never did a boot-time defrag, but when I checked the BootExecute value, it had been re-added. To find out exactly what was re-adding it, I removed "OODBS" again and added BootExecute to RegDefend and set it to Block from Modifying both Reg Keys and Values. I re-booted, expecting RD to block the change but when I checked the BootExecute value, the "OODBS" line had been added again. There was no mention of it in the RD log either. I'm reasonably sure that the O&O Defrag Agent (a Windows XP service) is the culprit, but wanted to be sure. How come RD is not catching this change and does this mean RD is flawed ?