KNOWN ISSUE: Spoolsv.exe process deletes the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" key
|Article:TECH164511|||||Created: 2011-07-13|||||Updated: 2011-07-13|||||Article URL http://www.symantec.com/docs/TECH164511|
|NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.|
After virtualising a PDF Writer application which contains the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" registry key, it was found that after a reboot that registry no longer existed.
After deactivating the layer, its writable section contains this registry key as a delete item, and it no longer exists in its readable section.
Process monitor captured the "spoolsv.exe" process as performing the delete action.
The following base behaviour on a vanilla Windows 7 machine was seen:
1. Disabling the spooler service and then rebooting the machine causes this HKLM\SYSTEM key to be deleted.
2. Either enabling the spooler service and rebooting or simply opening the “Devices and Printers” control panel applet causes the HKLM\SYSTEM key to be created again (the HKLM\SYSTEM key items seems to be created from the HKLM\SOFTWARE key items).
Windows 7 32 bit Service Pack (SP) 1
Symantec Workspace Virtualization (SWV) 6.1.5126 and later.
This issue is still under investigation; however, it could be related to Windows 7 using symbolic links for certain registry hives.
Symantec development are still investigating this issue.
|Value||2428295 - Spoolsv.exe process deletes the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" key|
Article URL http://www.symantec.com/docs/TECH164511