Endpoint Protection

 View Only
  • 1.  Windows server 2008 Event 1530

    Posted Nov 25, 2009 04:22 PM

    Description:
    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. 

     DETAIL -
     1 user registry handles leaked from \Registry\User\S-1-5-21-1447001783-2274183133-4180765549-1228:
    Process 328 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1447001783-2274183133-4180765549-1228\Printers\DevModePerUser



  • 2.  RE: Windows server 2008 Event 1530

    Posted Nov 25, 2009 04:52 PM


  • 3.  RE: Windows server 2008 Event 1530



  • 4.  RE: Windows server 2008 Event 1530

    Posted Nov 30, 2009 12:13 AM
    The link you referred only states:
    This behavior occurs because Windows automatically closes any registry handle to a user profile that is left open by an application. Windows Vista does this when Windows Vista tries to close a user profile.

    In versions of the Windows operating system that are earlier than Windows Vista or Windows 7, you must install the User Profile Hive Cleanup Service (UPHClean) utility to have the same functionality. However, the UPHClean utility is incompatible with Windows Vista and Windows 7. Additionally, the UPHClean utility is not needed because this functionality is built into Windows Vista.

    Note Event ID 1530 is logged as a Warning event. The application that is listed in the event detail is leaving the registry handle open and should be investigated.

    There is no solution.


  • 5.  RE: Windows server 2008 Event 1530

    Posted Nov 30, 2009 12:18 AM

    You have it backwards. The link you referenced is the where this problem was first mentioned. This link was the continuation of that link where I separated event ID 1530  from the other event IDs listed.