An old "cannot unload registry file" problem reappeared

[level13]

Some time ago (I think about 2 service-packs ago) there was a problem
with shutting down / logging off Windows 2000 as it would take a few
minutes for the process to complete, with the following entry in the
event log:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2006-10-21
Time: 10:29:51
User: NT AUTHORITY\SYSTEM
Computer: ****
Description:
Windows cannot unload your registry file. If you have a roaming
profile, your settings are not replicated. Contact your administrator.


DETAIL - Access is denied. , Build number ((2195)).


It was then resolved in a new service pack quite a while ago, but this
very problem reappeared this month again (I'm assuming it's one of the
Windows updates' fault because it's happened on two totally different
Windows 2000 computers after applying all Windows updates from this
month).
Anyone else noticed this? Any hints apart from waiting for another
patch to solve this?

 

[Dave Patrick]

This tool may help.

http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

| Some time ago (I think about 2 service-packs ago) there was a problem
| with shutting down / logging off Windows 2000 as it would take a few
| minutes for the process to complete, with the following entry in the
| event log:
|
| Event Type: Error
| Event Source: Userenv
| Event Category: None
| Event ID: 1000
| Date: 2006-10-21
| Time: 10:29:51
| User: NT AUTHORITY\SYSTEM
| Computer: ****
| Description:
| Windows cannot unload your registry file. If you have a roaming
| profile, your settings are not replicated. Contact your administrator.
|
|
| DETAIL - Access is denied. , Build number ((2195)).
|
|
| It was then resolved in a new service pack quite a while ago, but this
| very problem reappeared this month again (I'm assuming it's one of the
| Windows updates' fault because it's happened on two totally different
| Windows 2000 computers after applying all Windows updates from this
| month).
| Anyone else noticed this? Any hints apart from waiting for another
| patch to solve this?
|

 

[Jerold Schulman]

Some time ago (I think about 2 service-packs ago) there was a problem
with shutting down / logging off Windows 2000 as it would take a few
minutes for the process to complete, with the following entry in the
event log:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2006-10-21
Time: 10:29:51
User: NT AUTHORITY\SYSTEM
Computer: ****
Description:
Windows cannot unload your registry file. If you have a roaming
profile, your settings are not replicated. Contact your administrator.


DETAIL - Access is denied. , Build number ((2195)).


It was then resolved in a new service pack quite a while ago, but this
very problem reappeared this month again (I'm assuming it's one of the
Windows updates' fault because it's happened on two totally different
Windows 2000 computers after applying all Windows updates from this
month).
Anyone else noticed this? Any hints apart from waiting for another
patch to solve this?

See tip 7815 » Some user profiles will not unload?
in the 'Tips & Tricks' at http://www.jsifaq.com

See tip 7816 » How do I cause the User Profile Hive Cleanup Service (UPHClean) to log when it finds resources that won't otherwise close?

See tip 7817 » How do I cause the User Profile Hive Cleanup Service (UPHClean) to NOT force resources to close?

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

 

[Charlie]

I am also experiencing this symptom - noticeably slow shutdown of a w2k
sp4 system. I've checked the event log and determined that the error -
event id 1000, windows cannot unload your registry file - began
appearing 10/15/06, the day I downloaded and installed the latest batch
of MS updates. This is a home machine without a roaming profile or any
of that stuff.

Would anyone care to explain what this error really means? Is it a
problem I need to be concerned about or should I just live with it?

Per the suggestion from Dave Patrick, I've downloaded the User Profile
Hive Cleanup Service. I see I have a long readme to to view and attempt
to understand before I proceed with that.

I know just enough to be dangerous. I'll appreciate any information
that may help or enlighten me.

 

[Dave Patrick]

Also see Jerold's tip (in this same thread) on logging the resource that
doesn't close.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am also experiencing this symptom - noticeably slow shutdown of a w2k
| sp4 system. I've checked the event log and determined that the error -
| event id 1000, windows cannot unload your registry file - began
| appearing 10/15/06, the day I downloaded and installed the latest batch
| of MS updates. This is a home machine without a roaming profile or any
| of that stuff.
|
| Would anyone care to explain what this error really means? Is it a
| problem I need to be concerned about or should I just live with it?
|
| Per the suggestion from Dave Patrick, I've downloaded the User Profile
| Hive Cleanup Service. I see I have a long readme to to view and attempt
| to understand before I proceed with that.
|
| I know just enough to be dangerous. I'll appreciate any information
| that may help or enlighten me.
|

 

[Steve Parry]

Some time ago (I think about 2 service-packs ago) there was a problem
with shutting down / logging off Windows 2000 as it would take a few
minutes for the process to complete, with the following entry in the
event log:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2006-10-21
Time: 10:29:51
User: NT AUTHORITY\SYSTEM
Computer: ****
Description:
Windows cannot unload your registry file. If you have a roaming
profile, your settings are not replicated. Contact your administrator.


DETAIL - Access is denied. , Build number ((2195)).


It was then resolved in a new service pack quite a while ago, but this
very problem reappeared this month again (I'm assuming it's one of the
Windows updates' fault because it's happened on two totally different
Windows 2000 computers after applying all Windows updates from this
month).
Anyone else noticed this? Any hints apart from waiting for another
patch to solve this?

start
run
type
gpedit.msc

navigate to

Computer Configuration
Administrative Templates
System
Logon

Maximum retries to unload and update user profile ...

set enabled and to say 5 ... default if not configured is 60!!

also see

http://support.microsoft.com/default.aspx?scid=kb;en-us;837115&Product=win2000

in particular

"User Profile Hive Cleanup Service"

http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

 

[Gary Smith]

I believe this error means that changes made to the regiatry may not all
be written to disk when you shut down and will therefore be lost. I don't
think that's a good thing to live with. I installed UPHClean back when
the problem first showed up about two years ago and have been running with
it ever since. The program is completely unobtrusive, and I've never seen
the symptoms again. I wouldn't even be aware that it was running if it
weren't for the startup entries in the event log.

I am also experiencing this symptom - noticeably slow shutdown of a w2k
sp4 system. I've checked the event log and determined that the error -
event id 1000, windows cannot unload your registry file - began
appearing 10/15/06, the day I downloaded and installed the latest batch
of MS updates. This is a home machine without a roaming profile or any
of that stuff.

Would anyone care to explain what this error really means? Is it a
problem I need to be concerned about or should I just live with it?

 

[Charlie]

OK, per the suggestions posted here, I installed UPHClean. The system
then shut down in a timely manner and my event log contains an entry
for event ID 1401 stating that "The following handles in user profile
hive CHARLES-YJQJXO4\Charles
(S-1-5-21-73586283-1202660629-854245398-1000) have been remapped
because they were preventing the profile from unloading successfully:
svchost.exe (580) HKCU (0x754)." This doesn't mean a lot to me. I see
in the readme for UPHClean that there are options I can choose for
actions and logging. At the moment, I must have the defaults.

I wonder if I should be happy with things as they are or if I should
mess with the settings. More information in the log probably won't
inform me much.

And, thanks for the advice so far.

CW

 

[level13]

Same here, I get

The following handles in user profile hive ****\****
(S-1-5-21-682003330-573735546-725345543-1000) have been remapped
because they were preventing the profile from unloading successfully:

svchost.exe (592)
HKCU (0x7a4)


I think the number after HKCU varies each time, though.

 

[Gary Smith]

I think it's doing what it's supposed to, and I'd just let it go like
that. Eventually another update may fix the source of the problem and
UPHClean won't have anything to do any longer, but it doesn't hurt
anything to leave it running.

OK, per the suggestions posted here, I installed UPHClean. The system
then shut down in a timely manner and my event log contains an entry
for event ID 1401 stating that "The following handles in user profile
hive CHARLES-YJQJXO4\Charles
(S-1-5-21-73586283-1202660629-854245398-1000) have been remapped
because they were preventing the profile from unloading successfully:
svchost.exe (580) HKCU (0x754)." This doesn't mean a lot to me. I see
in the readme for UPHClean that there are options I can choose for
actions and logging. At the moment, I must have the defaults.

I wonder if I should be happy with things as they are or if I should
mess with the settings. More information in the log probably won't
inform me much.

 

[Attila]

Charlie, I have the same problem after apply the last hot-fix. I try to
find what hot-fix is responsable for the problem but i have no luck. I
still investigate...
I note the delay also at logon