dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
5009

Dustyn
Premium Member
join:2003-02-26
Ontario, CAN
·Carry Telecom
·TekSavvy Cable
Asus GT-AX11000
Technicolor TC4400

2 edits

1 recommendation

Dustyn

Premium Member

EVENT ID: 1517 "Microsoft User Profile Hive Cleanup Service

This seems to be a fairly common event viewer notice that I have come across on various computers, mine being one of them. I can not trace what program is accessing the registry while Windows XP is attempting to shut down. Do any of you guys receive this error in the event log?

Details
Product: Windows Operating System
Event ID: 1517
Source: Userenv
Version: 5.2
Symbolic Name: EVENT_HIVE_SAVED
Message: Windows saved user %1 registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Explanation
Windows unloads each user's profile and user's section of the registry when the user logs off. This message indicates that Windows could not unload the user's profile because a program was referencing the user's section of the registry. This locked the profile. The registry cannot unload profiles that are locked and in use. When the program that is locking the profile is no longer referencing the registry, the profile will be unloaded.

User Action
No user action is required.


--------------------------------------------------------------------------------

Related Knowledge Base articles
You can find additional information on this topic in the following Microsoft Knowledge Base articles:
• Warning error 1517 in Event Viewer after first restart
Explains the presence of an event log warning that appears when you first restart the computer after you install Windows XP.
• The DNS suffix of the computer name of a new domain controller may not match the name of the domain after you upgrade a Windows NT 4.0 primary domain controller to Windows 2000
Describes a problem where a domain controller's domain name system suffix does not match the domain name. To resolve this issue, install the latest service pack for Windows 2000, or upgrade the domain controller to Windows Server 2003.
• Troubleshooting profile unload issues
When you log off a computer that is running Microsoft Windows Server 2003, Windows XP, Windows 2000, or Windows NT 4.0, you may experience one or more of the following symptoms: A user profile does not unload.A roaming profile does not...
• How to troubleshoot RPC Endpoint Mapper errors
Describes how to recognize and troubleshoot RPC Endpoint Mapper errors when you use the Windows Server 2003 Resource Kit Tools and the Windows Server 2003 Support Utilities that are available on the Windows Server 2003 CD-ROM.
===

But there is a solution... And I have found it to eliminate the error. However, remove the UPHClean program/service, and the errors return. I have performed countless re-installs of XP and after loading my programs and tweaking my settings it re-appears in the event log. Only UPHClean seems to resolve the issue.

RESOLUTION:
To resolve this issue, use the "Microsoft User Profile Hive Cleanup Service" (UPHClean). UPHClean monitors the computer while Windows is unloading user profiles and forces resources that are open to close. Therefore, the computer can unload and reconcile user profiles.

To download and install UPHClean, visit the following Microsoft Web site:
»www.microsoft.com/downlo ··· 0E2F3582
===

Cudni
La Merma - Vigilado
MVM
join:2003-12-20
Someshire

Cudni

MVM

UPHClean logs in eventviewer, whenever it takes any action and in most cases reveal what causes the error

Cudni
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20 to Dustyn

Premium Member

to Dustyn
I used to get that error all the time on my first XP computer until I installed UPHClean. Then I got this new computer and promptly started getting the error again. I installed UPHClean and that solved the problem again.
dave
Premium Member
join:2000-05-04
not in ohio

dave to Dustyn

Premium Member

to Dustyn
The message said 'referencing' and not 'accessing'.

All that means is that there's some process running under the particular user account. It doesn't mean that this process is making registry accesses.

AB57
Premium Member
join:2006-04-04
equatorial

1 recommendation

AB57 to Dustyn

Premium Member

to Dustyn
You are not alone!
And good luck tracking down the process causing the issue. But it's a minor issue, and UPHClean will solve the problem, whatever it is.
I used to get those errors on a regular basis, UPHClean always having to do it's thing. Since a re-install, they only happen rarely. The issue/problem? God only knows. I think it's basically just a minor glitch or bug in the way Windows operates. What I DO know is that you could spend half your life trying to track it down!
My philosophy? Ignore it, and hopefully it will go away.

Dustyn
Premium Member
join:2003-02-26
Ontario, CAN
·Carry Telecom
·TekSavvy Cable
Asus GT-AX11000
Technicolor TC4400

Dustyn

Premium Member

Thanks for the replies guys.
I guess I'll install UPHClean again to correct the issue.
I thought however a fresh install would have corrected the problem but, looks like it didn't.

~Dusty~
UPHClean Link: »www.microsoft.com/downlo ··· 0E2F3582
Mele20
Premium Member
join:2001-06-05
Hilo, HI

Mele20

Premium Member

I had the error almost immediately on a brand new computer. So, for me I guess it is some program I have used for years and one I install right away...perhaps the Proxomitron? I just got UPHClean again like I did for my first computer with XP rather than try and figure it out.
Sympathy
join:2004-09-06
Newburgh, NY

Sympathy to Dustyn

Member

to Dustyn
I got the error the first time I turned on my brand new laptop. I installed UPHClean and the problem is solved. On my desktop I very rarely if ever get the error and don't even need the UPHClean. On both computers I have basically the same software installed, so go figure.
salahx
join:2001-12-03
Saint Louis, MO

1 recommendation

salahx to Dustyn

Member

to Dustyn
This is (usually) a non-error. The problem has to do with the way Windows is designed; essentially, Windows expects programs to be attached to login sessions, and for those programs to die when you log out (which causes the resources to be freed).

Windows considers it unusual when the login session has ended but the resources have still been "pinned" by an application not running in the login sessions.

This kind of thing is common in Unix: some programs will daemonize from user session (and thus keep running after the logout, like "screen" and "fetchmail"), or can be detached from the session ("nohup", "disown").

So the "error" isn't one at all; its just pointing out this as unusual and may not be what you expect and could need looking into. If you know this is in fact correct, just ignore it. Even if it isn't, its still harmless. (So really the point is this message shouldn't even be printed or there should be a knob to disable this "warning")

Dustyn
Premium Member
join:2003-02-26
Ontario, CAN

Dustyn

Premium Member

Thanks for the info.
It would be nice if there was a way for Windows not to log the event in the event viewer as an error/notice.
Libra
Premium Member
join:2003-08-06
USA

Libra to Dustyn

Premium Member

to Dustyn
I got the Event ID 1517 in our old XP and the one Dell replaced it with (XPHomesp2). UPHClean stopped the error messages on both. Then about two months ago I started getting the 1517 errors again and installed the newer version of UPHClean. That corrected the 1517 errors, but I notice that I get frequent UPHClean Event 1401 information notices saying the handles were remapped because they were preventing the profile from unloading successfully. They always point to SVCHost.exe and HKCU but the numbers referenced vary. I have one Admin account and two limited user accounts but these UPHClean event 1401s only pertain to one limited user. I wonder why.

Sincerely, Libra

nemo1966
join:2005-11-15
England

nemo1966 to salahx

Member

to salahx
said by salahx:

So the "error" isn't one at all; its just pointing out this as unusual and may not be what you expect and could need looking into. If you know this is in fact correct, just ignore it. Even if it isn't, its still harmless. (So really the point is this message shouldn't even be printed or there should be a knob to disable this "warning")
Thanks for the info, however I'd have to argue that in certain instances then it has to be more than just pointing something out.

e.g on one of my PCs, when the error has been issued its takes approx 2 minutes to shut the PC down. When I enable UPHClean and then run the same applications as before the PC takes approx 10 seconds to shut down.

If what you are saying is correct then XP is taking 2 minutes to write and entry to the Event Log and point out this is unusual and may not be what you expect and could need looking into.

?????
dave
Premium Member
join:2000-05-04
not in ohio

1 recommendation

dave

Premium Member

I'd guess (and it's only a guess) that the most likely explanation for that is that an attempt is repeatedly made to unload the hive. If it succeeds right away, as is usually the case, you're fine. If it does not succeed, then a retry is made. Lather, rinse, repeat. Eventually after N seconds the unload is given up, the event log record is written, etc.

This is pretty a standard feature of programming: failure very often takes longer than success.