Event Type: Warning Event Source: Userenv Event Type: No Event ID: 1517 Date: 2005-3-3 Event: 9:20:21 User: NT Authority / System: fuxiaozhang Description: Windows Save User Fuxiaozhang / PX Registration Table, because an application or service is still using this registry when logging out. The memory used by the user registry is not released. When the registry is no longer used, it will be uninstalled.
This is usually because the service is run according to the user's account. Try to configure the service to run with a local service or network service account.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Several important ports of MSN Messenger & Windows Messenger:
To Enable Voice and Video Communications with Windows Messenger Through A Non-UpNP Firewall, Configure The Firewall To Allow Incoming Traffic ON UDP Ports 5004 - 65535.
For Other Purposes, Enable the Following Ports:
• File Transfer: 6891 (To Allow 10 Simultaneous File Transfers, Open Ports 6891-6900)
• Application and WhiteBoard Sharing: 1503
• Remote Assistance: 3389 · MSM Messenger originally similar to HP free Email technical support:
Website: http://support.msn.com/contactus.aspx
A support for email today (although I am not very satisfied with this reply, but it is still a strongman than the HP!)
*********************************************************** **************************************************
Dear Your customers, you thank the letter to MSN Messenger and propose questions about speech.
For your question, it is recommended that you view the "Network Administrator" help.
>>> To view the Network Administrator Help, do the following:
1. From the Messenger main window, click Help, and then click Help Topics. 2. In the Help window, click All Topics tabs. 3. Open the Network Administrator Guide.
Your problem can be resolved here.
For other online help, please go: http://Messenger.msn.com/help/
Thank you for your consistent support for MSN Messenger, I hope that MSN Messenger will bring you more happiness!
Striry MSN Messenger Customer Support Center *************************************************** *********************************************************** ***
Just like the ICUC88 seniors say, the service is the key,
PS: I want to seek the opinions of ICUC88 seniors. I am still a big student, facing the system and development choice, I don't know if the predecessors do I should do it? Or can there be two people? ^ _ ^
My two wishes:
· Become MVSE, my own goal - Most Valuble System Engineer (most valuable MCSE) · Developing a smart operating system.
Now I have experienced this in this area, as for development or zero.
· An email received today:
In fact, in the XP system, a relatively common phenomenon, a log that often appears in the event log:
Event Type: Warning Event Source: Userenv Event Type: No Event ID: 1517 Date: 2004-5-13 Event: 22:39:38 User: NT Authority / System Computer: Mswinxphome Description: Windows Save User Mswinxphome / Youyang Registration Table, because an application or service is still using this registry when logging out. The memory used by the user registry is not released. When the registry is no longer used, it will be uninstalled.
This is usually because the service is run according to the user's account. Try to configure the service to run with a local service or network service account.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
In fact, this phenomenon is because some third-party programs have not released NTUSER.DAT files.
Solution:
Microsoft has a tool (it is actually a service)
Microsoft User Profile Hive Cleanup Service (Uphclean)
Http://www.microsoft.com/downloads/details.aspx?familyid=1b286e6d-8912-4e18-b570-42470e2f3582
Can Down to. Specific can look at its readme.txt file. Uphclean v1.5e readme.txtupdated march 4, 2004 by Robin Caron
All feedback appreciated to uphclean@microsoft.com
What is uphclean ================
Uphclean is a service That Once and for All Gets Rid of Problems with userprofile not unloading.
You are having profile unload problems if you experience slow logoff (withSaving Settings for most of the time while logging off), roaming profilesthat do not reconcile, or the registry size limit is reached.
Why do profiles not unload? ===========================
Many system and service processes do work on behalf of users. When the workis done the system or service process is responsible for releasing handles ithas to the user profile hive. If this is not done by the service as the userlogs off the profile can not be unloaded .This problem in code can be caused by improper coding either in Microsoftsoftware or 3rd party software (eg printer drivers, virus scanner service, etc). With the information provided by the system there is no way to findout what software needs to be corrected to Allow profiles to unload.
What does the user see? What happens to the profile? ====================================== ================
Windows NT4: The System Gives Up Immediately On Failure To Unload The profile the (roaming) profile is not recn.
Windows 2000:. The system attempts to unload the profile 60 times at 1 second intervals This retry logic rarely helps so in most cases after 60 seconds of the userwaiting at the Saving Settings message box the system gives up and roamingprofiles are not reconciled The number. of retries can be changed to allow theuser to log off faster (this can be done using the policy under ComputerConfiguration, Administrative Template, System, User Profiles, Maximum retriesto unload and update user profile)
Windows XP and 2003: The profile is reconciled using a copy of the contents of the registry Theuser is not made to wait as in Windows 2000. The problem left is that thecomputer can not recover the memory the profile uses until it can be unloaded..
Also in Some Cases (EG Using Anonymous Logons) You May Find That You Cannotlog On The Profile Cannot Be Unloaded.Why SHOULD I Use Uphclean? ===================== ======
In the past these issues have been fixed by code changes to release theregistry handle. The disadvantage of this approach is that in many casesmultiple issues (different code paths) are causing the profiles to notunload. Unless all problem code paths are fixed profiles do not unload .
The concept of UPHClean is to deal with these the same way the operatingsystem deals with other resource issues: when a task is done resources (memory, handles, etc) are automatically reclaimed UPHClean accomplishesthis simply by monitoring for users to log off and verifying that. unusedresources are reclaimed. If they are not it reclaims the resource and logsits action. This approach is superior as it works for any known reasonthat profiles do not unload and also will keep working to address newunknown issues.
Another advantage to UPHClean is that no computer restart is required to install it or remove it (except on Windows NT 4). You can install andremove UPHClean to find out whether it helps with a profile unload problem ornot. You can do this without having to Worry About What HotFix, Service Pack, Feature Pack, ETC HAS BEEN INSTALLED. SET IT AND Forget is The Goal Ofuphclean.
By default UPHClean takes action to allow profiles to unload You can choose to have UPHClean only report what processes it finds preventing profilesfrom unloading To do this, install UPHClean and use the registry editor toset..:
HKLM / System / CurrentControlSet / Services / UPHClean / Parameters / REPORT_ONLY to 1.You can also have UPHClean log the call stack that is responsible for theprofile hive handle. This is necessary to find out what software isresponsible for the hive handle in processes used for Many Purposes (egsvchost.exe, dllhost.exe, winmgmt.exe). To enable call stack logging usefulistry editor to set:
HKLM / System / CurrentControlSet / Services / Uphclean / Parameters / CallStack_Log To 1.
. Logging the call stack is computationally and memory intensive You should usethis option to collect information and then turn it off To get more accuratecall stack logging it may be necessary to get symbols installed on thecomputer You can read about getting symbols at..:
http://www.microsoft.com/whdc/ddk/debugging/symbols.mspx
How can I TELL IW I'M HAVING A Profile Unload ProBLEM? ==================================== ==================
Events are Recorded in The Event Log in Most Cases. You can Use Event Viewerto Look for the Following Events:
Windows NT 4:
The Application Event Log Has Error Events with Source Userenv, Event IS:
The Operating System WAS Unable to load your profile. Please contactour network administrator.
This is the only symptom you find in the event log of a Windows NT 4 computerindicating this problem is present. The only way to be sure is to use UPHCleanto find out if you have this problem or have some other problem.
Windows 2000:
The application event log has error events with source Userenv, event id1000 When you call up the event you get the one of following events:.. Windows can not unload your registry file If you have a roaming profile, your settings are not replicated Contact your. Administrator.
Detail - Access is Denied.
- OR -
Windows Cannot Unload Your Registry Class File. If You Have A RoamingProfile, Your Settings Are Not Replicated. Contact Your Administrator.
Detail Access is Denied.
- OR -
Windows Cannot Log You on Because The Profile Cannot Be loaded. ContactYour Network Administrator.
This Last Error is Relevant if you find one of the author ones earlierin the application log.
Windows XP and 2003:
You Will See of The Following Error Events in The Application Log:
Userenv / 1517:
Windows saved user X registry while an application or service was stillusing the registry during log off. The memory used by the user's registryhas not been freed. The registry will be unloaded when it is no longer in use.
This is the localservice or networkservice account.
Userenv / 1524:
Windows Cannot Unload Your Classes Registry File - IT IS Still in Use by OtheRapplications or Services. The File Will Be Unloaded When IT IT WILIN USE.
Userenv / 1500:
Windows can not log you on because your profile can not be loaded. Check that youare connected to the network, or that your network is functioning correctly. Ifthis problem persists, contact your network administrator.
This Last Error (1500) is Relevant if you find one of the Other ones Earlier INTHE Application Log.
INSTALLATION =================================================================================================================================================================
To Automatically Install IT (You NEED UPHCLEAN-SETUP.MSI): - Double Click The Setup.msito Manually Install It (You NEED A COPY OF Uphclean.exe):
- Create a directory under Program Files for the service (eg c: / program files / uphclean) - Copy the program (uphclean.exe) to the directory (eg c: / program files / uphclean / uphclean.exe) - Open a command prompt on the computer- Change directory where you copied the program (eg cd / program files / uphclean) - Run the program with the -install switch to install the service and start it (eg uphclean -install)
The service is set to automatically start when the computer boots so you willnot need to start it manually. Below I've listed the events that you will findin the application log when it takes positive steps to unload profile hives.
Installation problems =====================
IF you get an error using the msi installation package and the package is on a network share attempt the installation from a local driving. Another AlternativeIveis to Use the manual installation instructions.
IF you have problems with the installation check to see letter the folload dllsare in your C: / Winnt / System32 Directory:
MSVCP60.DLLMSVCRT.DLL
Thase Files Are Commonly On Computers Because.if You Are Missing There Files You CAN VISIT:
Http://support.microsoft.com/default.aspx?scid=259403
To Download Vcredist.exe Which Includes these Files.
On Windows NT4 You Will Need To Restart The Computer. On Restart Uphclean Will Start Automatically.
Upgrading =========
If you used the manual installation method to install UPHClean you must followthe manual removal instructions before attempting to use the MSI package toinstall. You can find out if you used the MSI package by looking for an entryfor User Profile Hive Cleanup Service in Add / Remove Programs Under Control Panel.if You Used The MSI Package To Install Then You Can Proceed with The New Packagewithout Removal.
REMOVAL =======
IF you use Automatic Installation: - Open Control Panel- Open Add / Remove Programs- Click ON User Profile Hive Service and SELECT Remove
If you manually installed: - Run the program with the service and remove it (e.g. uphclean -remove) - Remove The Uphclean Directory Under C: / Program Files
Logged events =============
1) Every Time The User Profile Hive Cleanup Service Starts:
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1001Date: 11/14 / 2003Time: 10:13:45 PMUser: N / AComputer: RCARONDOM-DC1Description: User Profile Hive Cleanup Service version 1.5.0.8 started successfully.
2) Every Time It Stops:
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1010Date: 7/11 / 2003Time: 11:12:06 PMUser: N / AComputer: RCARONDOM-DC1Description: User Profile Hive Cleanup Service stopped successfully.
3) Here the service is telling You That version of Handles That Were PreventingThe Profile from unloading:
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1201Date: 11/14 / 2003Time: 10:26:29 PMUser: RCARONDOM / u1Computer: RCARONDOM-DC1Description: The following handles in user profile hive RCARONDOM / u1 (S-1- 5-21-3230802392-3390281410-15605150281410-1560515013-1307) Have Been closed the profile from unloading successfully: Profleak.exe (1444) HKCU (0x144)
IF you have call stack logging the Event will Look Like THIS:
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1201Date: 10/21 / 2003Time: 5:17:38 PMUser: RCARONDOM-DC1 / u1Computer: RCARONDOM-DC1Description: The following handles in user profile hive RCARONDOM-DC1 / u1 ( S-1-5-21-3230802392-3390281410-15605150281410-15605150281410-1560515013-1307) Have been closed because the wre preventing the profile from unloading successfully:
profleak.exe (2604) HKCU (0x80) 0x77dfc200 ADVAPI32! TrackObject 0xe0x00412112 profleak!
4) Here's what it looks like the it's a problem closing handle held by application. I don't expect this will happen.
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1211Date: 7/11 / 2003Time: 9:46:29 PMUser: RCARONDOM / u1Computer: RCARONDOM-DC1Description: The following handles opened in user profile hive RCARONDOM / u1 (S-1 -5-21-3230802392-3390281410-1560515013-1307) Could not be closed:
Profleak.exe (1148) HKCU / Software / Policies (0xB0) Error 6
5) Here the service is telling you that the user profile hive could not be unloaded and that it will try again later. I expect that this will occur if the 1211 event occurred. As I do not expect 1211 to occur I'd expect that event id 1111 will not occur either.Event Type: WarningEvent Source: UPHCleanEvent Category: NoneEvent ID: 1111Date: 7/11 / 2003Time: 9:46:50 PMUser: RCARONDOM / u1Computer: RCARONDOM-DC1Description: User profile hive RCARONDOM / u1 . (S-1-5-21-323080230-156051502814107) Failed to unload. The unload will be retried.
6) If you are useless the reporting Only Mode (See Above on how to set) You willget Event ID 1501 WHENEVER UPHCLEAN DETECTS A User Logging Off and the profilebeing Held:
Event Type: InformationEvent Source: uphcleanEvent Category: NoneEvent ID: 1501Date: 7/11 / 2003Time: 11:19:49 PMUser: RCARONDOM / u1Computer: RCARONDOM-DC1Description: The following handles opened in user profile hive RCARONDOM / u1 (S-1 -5-21-3230802392-3390281410-1560515013-1307) Are preventing profiles from unloading:
Profleak.exe (1364) HKCU / Software / Policies (0xB4) HKCU (0xB8)
7) If you are using the reporting only mode (see above on how to set) you willget event id 1511 whenever UPHClean detects a hive loaded for an extendedperiod of time if the user is not logged on (whether there are handlesto it or not) ............................. ..
Event Type: InformationEvent Source: UPHCleanEvent Category: NoneEvent ID: 1511Date: 10/21 / 2003Time: 5:13:18 PMUser: RCARONDOM / u1Computer: RCARONDOMDescription: User profile hive RCARONDOM / u1 (S-1-5-21-3230802392- 3390281410-1560515013-1307) Is loaded evening user is not logged on.Uphclean history ================
Mar 4, 2004 V1.5E (Build 1.5.4.21)
Added code to handle closure of handles for registry keys that were deleted.This covers scenarios where an application keeps a handle to a deletedregistry key. In that case Userenv would log profile unload problem eventseven if UPHClean was running.
Feb 25, 2004 v1.5d (build 1.5.4.20)
Added code to force closure of registry handles protected from close. Thisavoids repeated events 1201 with the same process / handle combinations at 10second intervals. Modified code to avoid license violation error on NT4.
Feb 12, 2004 V1.5C (Build 1.5.0.18)
Cleaned up event 1201 message text. Added code to delay initial scan for profiles until operating system has been started for 1 minute. Added loggingcode for event id 1501 to include user name. First version available throughMicrosoft download.
JAN 14, 2004 V1.5B (Build 1.5.0.11)
Improved detection of profile hive unload problem to allow UPHClean to releasehive handles earlier than before allowing normal system function. With thischange the UPHClean 1201 event will be the only event logged.
Jan 5, 2004 V1.5 (Build 1.5.0.8)
Adding Code to Allow The Call Stack To Be Logged. Modified Code To Handlescenario Where Uphclean Would Not Clean Up Profile Handles If.
SEP 23, 2003 V1.2 (Build 1.2.0.7)
Modified code to allow it to run on Windows NT 4. Also added code to allowUPHClean to be used in monitoring mode. In this mode UPHClean reports whatprocess had handles to registry keys in user profile hives. The name of theprocess, its id, the registry Key Name Reported.sep 8, 2003 v1.1 (build 1.1.0.4)
Modified code flow to allow UPHClean to work on computers that do not haveterminal services. Modified code to immediately close handles to profile hivesupon detection of user logoff. The user can log off 20 seconds faster that way.
JUL 31, 2003 V1.0 (Build 1.0.0.2)
First Working Version.
Work Flow =========
hivestatus: hive name, prior refcount, refcounthivetounload: hive name, next attempt (60 seconds) pendinghiveunload: hive name, next attempt (10 seconds), last attempt (60 mins) handletoclose: handle info
WAIT Until Computer Has Been Up for 1 Minute
On Profile List Change Notify or Service Done or Timeout (10 Seconds if! Pendinghiveunload.empty Else 60 Seconds) if Service Done - EXIT
iterate through hive status:! prior refcount = refcountupdate refcountif refcount = 0 and loaded thenif prior refcount = 0 thenremove hive from hivetounloadadd hive to pendinghiveunload (next attempt = now, last attempt = now 65 mins) elseremove hive from hivetounloadremove hive from pendinghiveunload
Itere THROUGH PENDINGUNLOADIF LAST Attempt Passed The Move Hive To HiveTounLoad (Next Attempt = now)
if! pendinghiveunload.empty or! hivetounload.empty thenhandletoclose = nullget handlelistiterate through handlelistif (start (handle.name) in pendinghiveunload and nextattempt <= now) or (start (handle.name) in hivetounload and <= now nextattempt) thenadd entry to HandletoCloseProcess HandletoClose (All Handles On List Are To Be Closed)
Process HiveTounLoad (HiveS with nextattempt <= now shouth) no need to remove from list (Will Get Done At Next Hive Status Update)
