Windows Vista, Windows Server 2008 and UPHClean

re: Windows Vista, Windows Server 2008 and UPHClean

Phyriphiry — Sun, 22 Jun 2008 23:43:31 GMT

Hi, I have user profile unloading problem on my vista, just like hte one you are describing. I find the 1530-event in my eventviewer but I cannot see how I have to resolve this.

Can I work with you as a testcase or can you give me some hints on how I can find out which application prevents the profile from unloading ?

Thx.

re: Windows Vista, Windows Server 2008 and UPHClean

rcaron — Wed, 02 Jul 2008 17:14:02 GMT

Event 1530 tells you what application caused the problem. In the event listed above svchost in process 896 is the one causing a problem.

If you are unsure how to interpret the event post it here and I'll help.

Thank you,

Robin.

re: Windows Vista, Windows Server 2008 and UPHClean

Phyriphiry — Wed, 02 Jul 2008 19:50:13 GMT

I get every shutdown two messages of the type 1530.

These are the messages in the eventvwr: (it's in dutch, I ope you have enough with the technical stuff -otherwise I'll translate it).

-----------------------------------------------

Uw registerbestand is nog steeds in gebruik door andere toepassingen of services. Het bestand wordt nu verwijderd. De toepassingen en services die het registerbestand nu gebruiken, werken achteraf mogelijk niet meer goed.

DETAIL -

1 user registry handles leaked from \Registry\User\S-1-5-21-1564836495-3584289984-1312657921-1000_Classes:

Process 972 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1564836495-3584289984-1312657921-1000_CLASSES

AND

DETAIL -

1 user registry handles leaked from \Registry\User\S-1-5-21-1564836495-3584289984-1312657921-1000:

Process 972 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1564836495-3584289984-1312657921-1000

-----------------------------------------------

Some more information: When I look in the process viewer to see which svcprocesses are running: I find three processes with a PID around 972 :

- svchost.exe -k DcomLaunch under SYSTEM.

- svchost.exe -k rpcss under username NETWORK SERVICE.

- svchost.exe -k secsvcs under username SYSTEM.

Since I don't know the PID's at the moment of logoff, I am not sure which svchost is causing the problem.

I hope you have enough information to help me out and enough information to incorporate in your new vista-ready uphclean-version.

re: Windows Vista, Windows Server 2008 and UPHClean

Phyriphiry — Wed, 02 Jul 2008 20:09:55 GMT

Aha, I managed to find out which of the svchost processes is causing the problem.

(How? -> tasklist /v and tasklist /svc, save output in a file and perform a shutdown...).

It is WinDefend !!

Now I only have to find out why he does this...

re: Windows Vista, Windows Server 2008 and UPHClean

Flagman — Fri, 22 May 2009 08:07:37 GMT

"Windows Vista and Windows Server 2008 include the functionality of UPHClean."

(http://support.microsoft.com/kb/837115/en-us)