Yeah, I see - don't you hate it when you look so hard you miss the point. I'm sure that would disable it too - but disabling the service is far simpler! ) Tell me though, what is the reason for the sr.sys movement? Also should there be % symbols either side of systemroot or is it as it appears above? One more thing, just for my education - if I changed the service dword value to 3, that would be 'manual' - so should an instance where the service is needed occur - it should flag up a message and allow it to be activated right? Cheers, Chris.