When you use Regedt32 to double click:


you will note a Clone subkey that is not accessable.

The Clone subkey is built during system startup and contains a temporary copy of the control set that is being used to start the computer. When Winlogon reports that the startup was successful, the Clone subkey becomes the LastKnownGood control set.