After virtualising a PDF Writer application which contains the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" registry key, it was found that after a reboot that registry no longer existed.
After deactivating the layer, its writable section contains this registry key as a delete item, and it no longer exists in its readable section.
Process monitor captured the "spoolsv.exe" process as performing the delete action.
The following base behaviour on a vanilla Windows 7 machine was seen:
1. Disabling the spooler service and then rebooting the machine causes this HKLM\SYSTEM key to be deleted.
2. Either enabling the spooler service and rebooting or simply opening the “Devices and Printers” control panel applet causes the HKLM\SYSTEM key to be created again (the HKLM\SYSTEM key items seems to be created from the HKLM\SOFTWARE key items).
This issue is still under investigation; however, it could be related to Windows 7 using symbolic links for certain registry hives.
Symantec development are still investigating this issue.
Windows 7 32 bit Service Pack (SP) 1
Symantec Workspace Virtualization (SWV) 6.1.5126 and later.