In the Event Viewer Application log I see these warning messages when I shut-down the system - I feel they should not be there and it indicates NIS 2011 is not exiting correctly when asked? (I may be wrong so please correct me) === Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 8 user registry handles leaked from \Registry\User\S-1-5-21-700115100-184365736-2602770956-1004: Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 Process 2256 (\Device\HarddiskVolume1\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-700115100-184365736-2602770956-1004 ===