G
Guest
Dear all,
Here are the symptoms of a problem I have with my Windows XP Professional SP2:
At the very first, the follwoing Application event was logged:
Source: userenv
Type Warning
Event ID: 1517
This event indicates a problem while unloading the user profile during log
off. I installed the User Profile Hive Cleanup Service to locate the problem.
The tool logs now during shutdown the follwoing Application event:
Source: UPHClean
Type: Information
Event ID: 1401
The event tells me the hive was remapped because a svchost.exe process was
using HKCU keys.
I now used the SysInternals Process Explorer to find the svchost.exe process
that actually holds handles to HKCU keys and found out that the only HKCU
keys opened by a svchost.exe process belong to the Network Location Awareness
process (HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness).
My conclusion is that the NLA service must be the culprit. To me, this feels
like a bug in NLA...
The question is now:
How do I fix the problem??? My prefered solution conditions are:
- Without disabeling NLA
- Without running UHPClean all the time
- No event 1517 in the log
Would appriciate an "official answer" too..
Best regards,
Björn
Here are the symptoms of a problem I have with my Windows XP Professional SP2:
At the very first, the follwoing Application event was logged:
Source: userenv
Type Warning
Event ID: 1517
This event indicates a problem while unloading the user profile during log
off. I installed the User Profile Hive Cleanup Service to locate the problem.
The tool logs now during shutdown the follwoing Application event:
Source: UPHClean
Type: Information
Event ID: 1401
The event tells me the hive was remapped because a svchost.exe process was
using HKCU keys.
I now used the SysInternals Process Explorer to find the svchost.exe process
that actually holds handles to HKCU keys and found out that the only HKCU
keys opened by a svchost.exe process belong to the Network Location Awareness
process (HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Network\Location Awareness).
My conclusion is that the NLA service must be the culprit. To me, this feels
like a bug in NLA...
The question is now:
How do I fix the problem??? My prefered solution conditions are:
- Without disabeling NLA
- Without running UHPClean all the time
- No event 1517 in the log
Would appriciate an "official answer" too..
Best regards,
Björn