Event 1000 / unable to unload / slow shutdown / saving your

[steve K MCSE]

I posted on this last night but didn't want to have this
data lost in replies to that thread.

Having spent considerable time on this today as another
very important workstation began doing the event 1000 /
slow shutdown, cannot unload profile...

One can look at the userenv.log file to see what part of
the registry is hanging. In my case it is

machine 1: S-1-5-21-602162358-484763869-1343024091-500
mcahine 2: S-1-5-21-1547161642-436374069-8542455398-1001

The SIDs numbers are explained in a Q article Q243330 but
there is no S-1-5-21

Now, machine #2 was just built last night from a zero fill
drive, has no shares other than default and no network
users. I haven't a clue what to do to stop this error.

 

[steve]

I may have stumbled onto a REAL solution for this problem
and the cause - at least as far as our computers here are
involved.

All of ours are sufferng the failure to unload registry
key S-1-5-21-xxx . That seems to be the most common
failure people are having in this area even though print
spooler and all other kinds of things have been mentioned.

I read one article on Symantec NAV where someone
discovered that if you are running NAV Small
Business/Corporate 8.0 or 8.1 on W2000, it by default is
set to scan network drives and that causes this error. On
our computers running NAV 8.0, I opened configuration in
NAV and removed the check mark from scan network drives.
I also set exclusions to not scan drive A and network
drives when default scanning. This ended the 1000 userenv
slow shutdown issue on two computers with NAV 8.0. I have
not looked yet at those which are running NAV 2002 but I
have a suspicion that either they are trying to scan
network drives like Small Business/ Corporate Version is,
or there is a problem with permissions. NAV2002 must have
all users set to admin or errors can result. My guess is
that for many of us, this is a Symantec error.

Also, I found several articles where the Guest account can
cause problems that involved S-1-5-21-xxx. This makes
sense as NAV consumer version is tempermental about
permissions when it runs on W2000P.

The real problem here is that we are confined to
discussing these problems via support groups because the
software makers, Symantec, Microsoft etc want to be paid
to hear they have a bug. Recently we had a reasonably new
Adaptec card fail and they wanted $65 to discuss whether
it was defective or not. I hope this solves someone
else's problem with Userenv and I also hope Congress
cleans the clock on this poor support issue that come up
with software vendors.

Steve K, MCSE

 

[James]

Greetings,

Contrary to the poster's comment, I did find the following
Microsoft KB articles for the S-1-5-21 key:

http://support.microsoft.com/?kbid=328607
http://support.microsoft.com/?kbid=319909

He probably only found these:

http://support.microsoft.com/default.aspx?kbid=261007
http://support.microsoft.com/?kbid=269858

EventID.net has this long article for the 1000 event:

http://www.eventid.net/display.asp?eventid=1000&source=

There are umpteen processes which cause this - including
userenv (for which this article has several explanations
and suggested solutions).

I did a quick "Find" within this article for "s-1-5-21"
which occurs in several of the userenv sections and
perhaps, surprisingly, one for Frontpage!

Finally, here's a discussion which - later on - involves
the Event ID 1000/S-1-5-21 combination:

http://www.utteraccess.com/forums/showflat.php?
Cat=&Number=253428&page=1&view=collapsed&sb=5&o=&fpart=all&
vc=1

I hope all this helps - if you haven't fallen asleep
reading this post!

Kindest regards,

James