Message in Event Log

  • Thread starter Thread starter Ken Gash
  • Start date Start date
K

Ken Gash

I ran eventvwr.exe and viewed the Application event log. I found that
several times each day (probably when I shut down or rebooted) I got the
following Warning message:
Windows saved user KENCOMPUTER\Owner registry while an application or
service was still using the registry during log off. The memory used by
the user's registry has not been freed. The registry will be unloaded
when it is no longer in use.
This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Is this something I should worry about or try to fix, and if so, how do
I do that?

Thanks.
 
John

It does what you say it does. However, it does seem to replace one
report with another. It does not really seem to address the underlying
cause of the original error.

Any comments on this assertion?

--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
 
John

It does what you say it does. However, it does seem to replace one
report with another. It does not really seem to address the underlying
cause of the original error.

Any comments on this assertion?
Click to expand...

Specifically: What other report are you seeing?

In general: If the problem is due to corruption in the user profile, using
UPHClean will usually clear it up. If the problem is due to a slow closing
program, then it will persist. In some cases, this can be considered normal
but depends on the application involved.

Example: On my system I see this report now and again and can associate it
with using one particular program. When I don't use that program during a
session, the message is not present. In this case, I consider the "error"
as informational and not a problem.

Also see message occassionally when installing software that requires a
restart. Would hazard a guess that the "delay" is due to writing in the
registry or the creation of folders and files in my user profile that are
related to the new application.
 
Sharon

In part you are confirming my assertion but I accept the second report
is for Information. Actually when I came to get a copy of the latest
report I started to wonder whether there is an incorrect entry in the
registry. What do you make of it?

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 23.3.05
Time: 03:37:40
User: GERALD-0QR90GE9\Gerry Cornell
Computer: GERALD-0QR90GE9
Description:
The following handles in user profile hive GERALD-0QR90GE9\Gerry Cornell
(S-1-5-21-1960408961-1682526488-1957994488-1004) have been closed
because they were preventing the profile from unloading successfully:

svchost.exe (688)
HKCU (0x390)


--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
 
Gerry,
If your seeing a UPHClean entry that it successfully allowed the profile to
unload then this is normal. If your seeing another error in its place then
pos the error back here so that we can follow-up on this.
John
 
Sharon

In part you are confirming my assertion but I accept the second report
is for Information. Actually when I came to get a copy of the latest
report I started to wonder whether there is an incorrect entry in the
registry. What do you make of it?

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 23.3.05
Time: 03:37:40
User: GERALD-0QR90GE9\Gerry Cornell
Computer: GERALD-0QR90GE9
Description:
The following handles in user profile hive GERALD-0QR90GE9\Gerry Cornell
(S-1-5-21-1960408961-1682526488-1957994488-1004) have been closed
because they were preventing the profile from unloading successfully:

svchost.exe (688)
HKCU (0x390)
Click to expand...

It would appear that these were the "problem areas" that UPHClean found
but, boy, this description it coughed up is not very useful.

Svchost.exe, as you know, hosts a myriad of functions but the report isn't
telling you anything helpful to target the offending function. Also "HKCU"
is too general since it encompasses the entire current user registry branch
that is active when your account is logged on (HKU is global to all users.
HKCU is current user). In other words, the report from UPHClean doesn't
really tell what it fixed, just that it fixed "something."

Aside (again, I think that you already know this): You shouldn't see this
report at every startup. UPHClean should be run once and then put into
retirement until it's needed again. If Event Viewer returns to the original
message about a delay in unloading the user portion of the registry, I feel
it would be safe at this point to assume it is "normal" for the existing
setup.
 
Sharon

This particular version of svchost.exe is used by DCOM and Terminal
Services. My nose led me Roxio and Photosuite 5 but I got no further. I
have Easy CD & DVD Creator 6 of which this is part. I do not use the
programme daily so I might try stopping it loading ( or turning it off )
before shutting down and seeing if the message still appears. I suppose
the first step would be to stop svchost.exe (688) first and see if the
Information message does not appear.

Any thoughts.


--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
 
Sharon F said:
It would appear that these were the "problem areas" that UPHClean found
but, boy, this description it coughed up is not very useful.

Svchost.exe, as you know, hosts a myriad of functions but the report isn't
telling you anything helpful to target the offending function. Also "HKCU"
is too general since it encompasses the entire current user registry
branch
that is active when your account is logged on (HKU is global to all users.
HKCU is current user). In other words, the report from UPHClean doesn't
really tell what it fixed, just that it fixed "something."


Aside (again, I think that you already know this): You shouldn't see this
report at every startup. UPHClean should be run once and then put into
retirement until it's needed again.
Click to expand...
Once you run UPHClean it should never need to be run again as it runs as a
service from then on (even after rebooting) and this is why he constantly
has this entry in the Event log :-)


If Event Viewer returns to the original
 
Back
Top