regdefend blocking svchost limited acct?

running current regdefend on w2k. gss/rd mostly well-behaved, but when I'm logged in as admin, and then logoff admin, and login as limited (restricted) user, I get a balloon window (not normal rd info window) that says that "rd blocked svchost PID 540 from modifying protected registry value." (paraphrase as the balloon disappears after a few seconds). I get no regular rd popup, so it is unclear what was blocked, and no control by me as limited user. except for that balloon alert, all seems normal on w2k and rd while running limited user. anyone see this? is it normal behavior? does it indicate some sort of problem? and is there a tweak I need to do?