I get these two events in the Event Viewer all of the time now...
Event ID 1001 UPHClean started
Event ID 1201 UPHClean The following handles in user profile hive
MYPENTIUM450\Wesley P. Vogel (S-...) have been closed because they were
preventing the profile from unloading successfully
You will most certainly have some also.
To open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click on system on the left
Some more events that you might see, from
UPHClean v1.6d readme.txt
http://download.microsoft.com/download/a/8/7/a87b3d05-cd04-4743-a23b-b16645e075ac/readme.txt
LOGGED EVENTS
=============
1) Every time the User Profile Hive Cleanup service starts:
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1001
Date: 11/14/2003
Time: 10:13:45 PM
User: N/A
Computer: RCARONDOM-DC1
Description:
User Profile Hive Cleanup Service version 1.X.Y.Z started successfully.
2) Every time it stops:
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1010
Date: 7/11/2003
Time: 11:12:06 PM
User: N/A
Computer: RCARONDOM-DC1
Description:
User Profile Hive Cleanup Service stopped successfully.
3) Here the service is telling you that it closed handles that were
preventing
the profile from unloading:
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 11/14/2003
Time: 10:26:29 PM
User: RCARONDOM\u1
Computer: RCARONDOM-DC1
Description:
The following handles in user profile hive RCARONDOM\u1
(S-1-5-21-3230802392-3390281410-1560515013-1307) have been closed because
they
were preventing the profile from unloading successfully:
profleak.exe (1444)
HKCU (0x144)
4) Here's what it looks like if there's a problem closing handle held by
application.
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1211
Date: 7/11/2003
Time: 9:46:29 PM
User: RCARONDOM\u1
Computer: RCARONDOM-DC1
Description:
The following handles opened in user profile hive RCARONDOM\u1
(S-1-5-21-3230802392-3390281410-1560515013-1307) could not be closed:
profleak.exe (1148)
HKCU\SOFTWARE\Policies (0xb0) error 6
5) Here the service is telling you that the user profile hive could not be
unloaded and that it will try again later. I expect that this will occur
if the 1211 event occurred. As I don't expect 1211 to occur I'd expect that
event id 1111 will not occur either.
Event Type: Warning
Event Source: UPHClean
Event Category: None
Event ID: 1111
Date: 7/11/2003
Time: 9:46:50 PM
User: RCARONDOM\u1
Computer: RCARONDOM-DC1
Description:
User profile hive RCARONDOM\u1
(S-1-5-21-3230802392-3390281410-1560515013-1307)
failed to unload. The unload will be retried.
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In