To create a log file of all roaming profile transactions using the checked version of UserEnv.dll. The checked version of the dll is the same as the retail version, except that it contains debug flags that can be set and used with the kernel debugger. It is included in both the Windows Device Driver Kit (DDK) and the NT Software Development Kit (SDK).

1. Rename the Userenv.dll file in the %systemroot%\System32 directory to Usernv.org.
   C:\> rename %systemroot%\system32\userenv.dll userenv.org
2. Copy the checked version of Userenv.dll to the %systemroot%\System32 directory of the client computer that you want to debug. The checked version of the Userenv file must match the version of the operating system being used.
   C:\> copy userenv.chk %systemroot%\system32\userenv.dll
3. Apply the following registry hack:

   Hive: HKEY_LOCAL_MACHINE
   Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   Name: UserEnvDebugLevel
   Type: REG_DWORD
   Value: 10002
   

A log file of the roaming profile transactions will be written to userenv.log to the root of the C: drive.