Window 2008 creating *.tmp files

Twice in the last couple of months we've found that a application.ini file appears to have been renamed to application.ini.tmp.

We don't have an explanation for this, but the date/time stamp of the file seems to correlate to when we've had to recycle a service (which runs an application) or reboot the book (which would also stop a service).

Can anyone confirm or refute the theory that if a service won't shutdown gracefully and is holding open a file (in this case this *.ini file) or maybe in general if files are still open during a reboot that Windows may create a *.tmp copy of those "open" files in some situation?

It seems like a nice "fail safe" although, the downside of it is that the renamed file won't be found by the service.