New Microsoft tool: User Profile Hive Cleanup Service

[steves]

I notice that there is a new service, the "User Profile Hive Cleanup
Service",
available for download from Microsoft, here:

http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

Microsoft's Overview is as follows:
<Overview>
The User Profile Hive Cleanup service helps to ensure user sessions are
completely terminated when a user logs off. System processes and
applications occasionally maintain connections to registry keys in the
user profile after a user logs off. In those cases the user session is
prevented from completely ending. This can result in problems when
using Roaming User Profiles in a server environment or when using
locked profiles as implemented through the Shared Computer Toolkit for
Windows XP.

On Windows 2000 you can benefit from this service if the application
event log shows event id 1000 where the message text indicates that the
profile is not unloading and that the error is "Access is denied". On
Windows XP and Windows Server 2003 either event ids 1517 and 1524
indicate the same profile unload problem.

To accomplish this the service monitors for logged off users that still
have registry hives loaded. When that happens the service determines
which application have handles opened to the hives and releases them.
It logs the application name and what registry keys were left open.
After this the system finishes unloading the profile.
</Overview>

I have had many such error events logged in my XPE build, and am
looking forward to trying this out. I will let everyone know what I
find...

SteveS
StevesATeyeDASHimagingDOTcom

 

[steves]

Well, after reading about it more, it's not a new tool, but it does
seem like it will help clean up my event logs, if I can figure out what
it's telling me...

I now have an Eventlog Entry as follows:
------------------------------------------------------------------------------------------------
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1401
Date: 2/13/2006
Time: 10:57:50 AM
User: ABDV3-0001\Administrator
Computer: ABDV3-0001
Description:
The following handles in user profile hive ABDV3-0001\Administrator
(S-1-5-21-484763869-1202660629-839522115-500) have been remapped
because they were preventing the profile from unloading successfully:

svchost.exe (1004)
HKCU (0x314)
------------------------------------------------------------------------------------------------
So, It seems as if a service is indeed guilty, but which one? Can I
Decode those hex values
in the Eventlog entry: (svchost.exe (1004))? Who would have a handle
to the HKCU root open?

All of my services run as Local System, Local Service, or Network
service. None are configured to run under user accounts that I know
of.

Thanks in advance...
SteveS
stevesATeyeDASHimagingDOTcom