Windows 7 - This in Event Viewer

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-1215785520-2173831582-646944407-1000:
Process 552 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1215785520-2173831582-646944407-1000
Process 552 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1215785520-2173831582-646944407-1000
Process 552 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1215785520-2173831582-646944407-1000\Software\Microsoft\SystemCertificates\My
Process 552 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1215785520-2173831582-646944407-1000\Software\Microsoft\SystemCertificates\CA
Process 552 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1215785520-2173831582-646944407-1000\Software\Microsoft\SystemCertificates\Disallowed

I am getting this seems to be on restarts, i got a couple of them what is it?

Hello,

Here the Microsoft KB for this issue Event ID: 1530 may be logged in the Application log on a Windows 7-based or Windows Vista-based client computer

Hope this helps,
Captain

You may want to have a look at this: What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?
But if you run Spybot, you may have a lot of legit entries (from Spybot).

So basically this is normal?

Yup Microsoft says "This behavior is by design"

Hope this helps,
Captain

Yes that does, thank you very much.