Ok, I properly understand it now. In HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce nlite puts 3 commands, which anybody who uses nlite may have seen popping up the first time they log on. I had no idea what they were until now. One of these commands uses c:/windows/inf/nlite.inf to change various settings that are specified when using nlite to create an installation CD. This file has a line that sets the lanmanserver startup registry value to 4. As this is in the default user runonce, it ran every time I created and logged on to a new user, disabling the service. I've just changed the value 4 to 2 in the inf and left it as it is. Hope this helps anyone else who may have this problem.