Merry.Win,
Well, honestly, if the issue is only due to some timing at the system boot time, it may be not easy to find out he source who keeps
the file locked at the boot time.
First of all, you should carefully review all the services, Run/RunOnce and Start Up programs on your image runtime. Maybe you will
be able to find the faulty component just from the service name.
Otherwise you can try to use audit techniques to find out who's trying to access the LDF file. The audit will only work for you if
you use NTFS file system. Here is how you set up the audit on particular file:
http://support.microsoft.com/kb/310399. You should
probably set the Success and Failure audit event on that file to see all the attempts to access it. Easiest way to make the audit
and Local Security Policies work on your image is to include Administrative Tools Support component and resolve its dependencies.
Otherwise, AuditPol.exe command line tool from Resource Kit may be used.