Advice Regarding Event "Warning"

[JD]

I never saw this type of Event before SP2. Now I get one every day. Can
anyone advise me as to what it means? I have read it but don't understand
it.
How, for instance, does a home user (not networked) "configure the services
to run in either the LocalService or NetworkService account"?
Could the "application" in question be the anti-virus program? I'm in the
habit of closing all other apps before shutting down Windows.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 9/14/2004
Time: 3:05:21 AM
User: NT AUTHORITY\SYSTEM
Computer: GATEWAY...
Description:
Windows saved user GATEWAY...\Owner registry while an application or service
was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Guest]

Please see this:
http://www.eventid.net/display.asp?app=ElUnDump&source=Userenv&eventid=1517

The following link should help with background applications cleanup:

Clean Windows Startup and hidden Startup:
http://www.fixyourwindows.com/optimizewindowsstartup.htm

Hope this helps!
---
Spyware/Virus Removal and Prevention:
http://www.fixyourwindows.com/windowsxpsolutions.htm
(Links to online virus scans on the same page)

How to successfully install Windows XP Service Pack 2:
http://www.fixyourwindows.com/winxpsp2install.htm

How to optimize Windows XP, 2000, ME
for the best performance (Step-by-step Visual Guide):
http://www.fixyourwindows.com

 

[dev]

/JD/ said:

I never saw this type of Event before SP2. Now I get one every day. Can
anyone advise me as to what it means? I have read it but don't understand
it.
How, for instance, does a home user (not networked) "configure the services
to run in either the LocalService or NetworkService account"?
Could the "application" in question be the anti-virus program? I'm in the
habit of closing all other apps before shutting down Windows.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 9/14/2004
Time: 3:05:21 AM
User: NT AUTHORITY\SYSTEM
Computer: GATEWAY...
Description:
Windows saved user GATEWAY...\Owner registry while an application or service
was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I see it here from time to time. It happens at shutdown, and is a warning
that you can ignore.

 

[JD]

Thanks Dev and r for your responses. I'd, of course, still like to know why
it's happening now (on every shutdown), only since SP2.
Also what is meant by "configure services to run in LocalService or
NetworkService account"? I would assume that the "default" configuration is
the best, especially for a non-guru, but don't really understand what this
particular recommendation (from MS) means.
There is no noticeable slowness in shutdown time, and probably it is best to
just ignore it. But still, I'd like to understand it...

 

[frodo]

my system reports this now too, after sp2.

if you install the User Profile Hive Cleanup Service (as recommended by
the KB) you'll find that the faulting process is scvhost, and if you use
sysinternal's Process Explorere you'll find that the particular instance
of svchost causing the problem is the DCOM Server Process Launcher
service, new for SP2. This new service is a bit of a mystery, the only
thing I've found is that if you disable it everything seems to work just
fine, until you launch SysInfo - it reports a "communications error w/
WMI". reenable the service and SysInfo (msinfo.exe) works fine.

You'll notice that the "command line" for this new service is IDENTICAL to
the command line for the Terminal Services service - interesting.

I have not been able to make this warning go away, I suspect there's a
minor bug in the new service.

I'm waiting for Black Viper to figure things out with re: to the new SP 2
services and update his site, but he's been busy, as have we all!

For now don't worry, it's minor I think.

YOUR REGISTRY IS JUST FINE, this error is not causing a registry
update/closing problem, tho the wording is somewhat foreboding.

 

[JD]

As Lewis Carroll would say, "Curiouser and curiouser."
I really appreciate your thoughtful response, and I'm guessing some others
will too when they notice the post-SP2 Event "Warning."
I had downloaded the UPHC setup file, but was not eager to install and run
it. Your experience and info are most appreciated.
Let's, indeed, see what Black Viper (or the Elder Geek, or Kelly Theriot)
come up with on this one.
Regards, Jim