Whats the purpose of the Winlogon\LeakTrack windows registry key?

Question

What is the purpose of this registry key

HKLM\SOFTWARE\Microsoft\WINDOWS NT\CURRENTVERSION\Winlogon\LeakTrack

I am writing a system state backup solution and this came up in my research. Could not find any docs on it though

Answer 1

This key has do with the registry handle leak tracking functionality within Windows. It has the following spec:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Name: LeakTrack
Type: REG_DWORD
Data: 0 or 1

If LeakTrack is set to 1 (one), Windows tracks all open registry keys and detect if any are leaked. This registry key is not required for normal operating system functionality.

The functions in ADVAPI32.dll (the registry API) responsible for getting a registry key handle read this value. When the value is set appropriately they collect a call stack whenever they are asked to get a registry key under the user profile hives. Later when the registry keys are release closed it removes the discards the collected call stack information.

It is needed only for debug sessions when memory leaks are to be tracked. The value is set by Microsofts UPHClean (User Profile Hive Cleanup Service ) service for example.