SP2 created problem

[snowball]

I just have one problem created by the sp2 installation. I now get event: id
1517. constantly in event viewer for applications. Anyone else get this
problem and resolve it without the use of UPHClean? Thanks.

[Gerry Cornell]

http://www.eventid.net/display.asp?eventid=1517&eventno=1206&source=Userenv&phase=1

More information e.g an exact copy of the Error Report from Event Viewer
would be helpful.

Make an exact note of the precise text of any error message. Minor
discrepancies can
make it harder to search for information about the error message.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer.
When researching the meaning of the error, information regarding Event
ID, Source
and Description are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the
error you want to copy. In the window, which appears is a button
resembling two
pages. Double click the button and close Event Viewer. Now start your
message
(email) and do a paste into the body of the message. This will paste the
info from the
Event Viewer Error Report complete with links into the message. Make
sure this is
the first paste after exiting from Event Viewer.

In Event Viewer there is no facility to print Error Reports. A
workaround is copy and
paste the Error Report into an email, send it to yourself and print off
the copy in your
Inbox or your Sent Items folder.

--

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

http://dts-l.org/goodpost.htm

~~~~~~~~~~~~~~~~~~~~~~~~

"snowball" > wrote in message
...
>I just have one problem created by the sp2 installation. I now get
>event: id 1517. constantly in event viewer for applications. Anyone
>else get this problem and resolve it without the use of UPHClean?
>Thanks.
>

[snowball]

Here's the exact message:

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 9/4/2004
Time: 9:51:14 PM
User: NT AUTHORITY\SYSTEM
Computer: JERRIES
Description:
Windows saved user JERRIES\xxxxxxxxxx registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.




For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Gerry Cornell" > wrote in message
...
> http://www.eventid.net/display.asp?eventid=1517&eventno=1206&source=Userenv&phase=1
>
> More information e.g an exact copy of the Error Report from Event Viewer
> would be helpful.
>
> Make an exact note of the precise text of any error message. Minor
> discrepancies can
> make it harder to search for information about the error message.
>
> You can access Event Viewer by selecting Start, Administrative Tools,
> Event Viewer.
> When researching the meaning of the error, information regarding Event ID,
> Source
> and Description are important.
>
> A tip for posting copies of Error Reports! Run Event Viewer and double
> click on the
> error you want to copy. In the window, which appears is a button
> resembling two
> pages. Double click the button and close Event Viewer. Now start your
> message
> (email) and do a paste into the body of the message. This will paste the
> info from the
> Event Viewer Error Report complete with links into the message. Make sure
> this is
> the first paste after exiting from Event Viewer.
>
> In Event Viewer there is no facility to print Error Reports. A workaround
> is copy and
> paste the Error Report into an email, send it to yourself and print off
> the copy in your
> Inbox or your Sent Items folder.
>
> --
>
> ~~~~~~
>
>
> Hope this helps.
>
> Gerry
> ~~~~~~~~~~~~~~~~~~~~~~~~
> FCA
>
> Stourport, Worcs, England
> Enquire, plan and execute.
> ~~~~~~~~~~~~~~~~~~~~~~~~
> Please tell the newsgroup how any
> suggested solution worked for you.
>
> http://dts-l.org/goodpost.htm
>
> ~~~~~~~~~~~~~~~~~~~~~~~~
>
> "snowball" > wrote in message
> ...
>>I just have one problem created by the sp2 installation. I now get event:
>>id 1517. constantly in event viewer for applications. Anyone else get this
>>problem and resolve it without the use of UPHClean? Thanks.
>>
>

[snowball]

Here's the message UPHclean gives when it releases the handles:


Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 10/18/2004
Time: 3:30:48 AM
User: JERRIES\xxxxxxx
Computer: JERRIES
Description:
The following handles in user profile hive JERRIES\Jerry Sopko
(S-1-5-21-851260465-2133605401-951809763-1006) have been closed because they
were preventing the profile from unloading successfully:

svchost.exe (1036)
HKCU\Software\Microsoft\SystemCertificates\CA (0x1514)
HKCU\Software\Microsoft\SystemCertificates\Root (0x1528)
HKCU (0x152c)
HKCU\Software\Microsoft\SystemCertificates\trust (0x1554)
HKCU (0x1558)
HKCU\Software\Microsoft\SystemCertificates\My (0x155c)
HKCU\Software\Policies\Microsoft\SystemCertificate s (0x157c)
HKCU\Software\Policies\Microsoft\SystemCertificate s (0x1594)





For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Gerry Cornell" > wrote in message
...
> http://www.eventid.net/display.asp?eventid=1517&eventno=1206&source=Userenv&phase=1
>
> More information e.g an exact copy of the Error Report from Event Viewer
> would be helpful.
>
> Make an exact note of the precise text of any error message. Minor
> discrepancies can
> make it harder to search for information about the error message.
>
> You can access Event Viewer by selecting Start, Administrative Tools,
> Event Viewer.
> When researching the meaning of the error, information regarding Event ID,
> Source
> and Description are important.
>
> A tip for posting copies of Error Reports! Run Event Viewer and double
> click on the
> error you want to copy. In the window, which appears is a button
> resembling two
> pages. Double click the button and close Event Viewer. Now start your
> message
> (email) and do a paste into the body of the message. This will paste the
> info from the
> Event Viewer Error Report complete with links into the message. Make sure
> this is
> the first paste after exiting from Event Viewer.
>
> In Event Viewer there is no facility to print Error Reports. A workaround
> is copy and
> paste the Error Report into an email, send it to yourself and print off
> the copy in your
> Inbox or your Sent Items folder.
>
> --
>
> ~~~~~~
>
>
> Hope this helps.
>
> Gerry
> ~~~~~~~~~~~~~~~~~~~~~~~~
> FCA
>
> Stourport, Worcs, England
> Enquire, plan and execute.
> ~~~~~~~~~~~~~~~~~~~~~~~~
> Please tell the newsgroup how any
> suggested solution worked for you.
>
> http://dts-l.org/goodpost.htm
>
> ~~~~~~~~~~~~~~~~~~~~~~~~
>
> "snowball" > wrote in message
> ...
>>I just have one problem created by the sp2 installation. I now get event:
>>id 1517. constantly in event viewer for applications. Anyone else get this
>>problem and resolve it without the use of UPHClean? Thanks.
>>
>

[davexnet02]

I tried an alternative approach. I used this tool in reporting mode
to find out what svchost was responsible.
Then used Tasklist /svc to get the individual services.
Then I used a LOGOFF script, set with gpedit, to issue
a net stop command for those services.

It's only partially successful; one of the services was DCOM
LAUNCH which for some reason, doesn't accept a STOP command.

I'm still looking to see if anything else can be done.
I don't like the idea of having uphclean constantly running.
Sounds like a cop out on microsoft's part.

Dave







On Thu, 21 Oct 2004 22:52:15 -0500, "snowball" > wrote:
>Here's the message UPHclean gives when it releases the handles:
>
>
>Event Type: Information
>Event Source: UPHClean
>Event Category: None
>Event ID: 1201
>Date: 10/18/2004
>Time: 3:30:48 AM
>User: JERRIES\xxxxxxx
>Computer: JERRIES
>Description:
>The following handles in user profile hive JERRIES\Jerry Sopko
>(S-1-5-21-851260465-2133605401-951809763-1006) have been closed because they
>were preventing the profile from unloading successfully:
>
>svchost.exe (1036)
> HKCU\Software\Microsoft\SystemCertificates\CA (0x1514)
> HKCU\Software\Microsoft\SystemCertificates\Root (0x1528)
> HKCU (0x152c)
> HKCU\Software\Microsoft\SystemCertificates\trust (0x1554)
> HKCU (0x1558)
> HKCU\Software\Microsoft\SystemCertificates\My (0x155c)
> HKCU\Software\Policies\Microsoft\SystemCertificate s (0x157c)
> HKCU\Software\Policies\Microsoft\SystemCertificate s (0x1594)
>
>
>
>
>
>For more information, see Help and Support Center at
>http://go.microsoft.com/fwlink/events.asp.
>
>"Gerry Cornell" > wrote in message
...
>> http://www.eventid.net/display.asp?eventid=1517&eventno=1206&source=Userenv&phase=1
>>
>> More information e.g an exact copy of the Error Report from Event Viewer
>> would be helpful.
>>
>> Make an exact note of the precise text of any error message. Minor
>> discrepancies can
>> make it harder to search for information about the error message.
>>
>> You can access Event Viewer by selecting Start, Administrative Tools,
>> Event Viewer.
>> When researching the meaning of the error, information regarding Event ID,
>> Source
>> and Description are important.
>>
>> A tip for posting copies of Error Reports! Run Event Viewer and double
>> click on the
>> error you want to copy. In the window, which appears is a button
>> resembling two
>> pages. Double click the button and close Event Viewer. Now start your
>> message
>> (email) and do a paste into the body of the message. This will paste the
>> info from the
>> Event Viewer Error Report complete with links into the message. Make sure
>> this is
>> the first paste after exiting from Event Viewer.
>>
>> In Event Viewer there is no facility to print Error Reports. A workaround
>> is copy and
>> paste the Error Report into an email, send it to yourself and print off
>> the copy in your
>> Inbox or your Sent Items folder.
>>
>> --
>>
>> ~~~~~~
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>> FCA
>>
>> Stourport, Worcs, England
>> Enquire, plan and execute.
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>> Please tell the newsgroup how any
>> suggested solution worked for you.
>>
>> http://dts-l.org/goodpost.htm
>>
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>>
>> "snowball" > wrote in message
>> ...
>>>I just have one problem created by the sp2 installation. I now get event:
>>>id 1517. constantly in event viewer for applications. Anyone else get this
>>>problem and resolve it without the use of UPHClean? Thanks.
>>>
>>
>

[snowball]

I agree Dave, it is a cop out on Microsoft's part. Indeed a third party cop
out. Specifically, my problem started with the download of the upgraded
update site prior to installing sp2. This I know because I upgraded the
update site first. then the problem began. I then upgraded to sp2 a few days
later. I tried removing all services associated with sp2 to no avail. My
suspicion is the problem is buried somewhere in the updated security and it
may not be service related.


"davexnet02" > wrote in message
...
>I tried an alternative approach. I used this tool in reporting mode
> to find out what svchost was responsible.
> Then used Tasklist /svc to get the individual services.
> Then I used a LOGOFF script, set with gpedit, to issue
> a net stop command for those services.
>
> It's only partially successful; one of the services was DCOM
> LAUNCH which for some reason, doesn't accept a STOP command.
>
> I'm still looking to see if anything else can be done.
> I don't like the idea of having uphclean constantly running.
> Sounds like a cop out on microsoft's part.
>
> Dave
>
>
>
>
>
>
>
> On Thu, 21 Oct 2004 22:52:15 -0500, "snowball" > wrote:
>>Here's the message UPHclean gives when it releases the handles:
>>
>>
>>Event Type: Information
>>Event Source: UPHClean
>>Event Category: None
>>Event ID: 1201
>>Date: 10/18/2004
>>Time: 3:30:48 AM
>>User: JERRIES\xxxxxxx
>>Computer: JERRIES
>>Description:
>>The following handles in user profile hive JERRIES\Jerry Sopko
>>(S-1-5-21-851260465-2133605401-951809763-1006) have been closed because
>>they
>>were preventing the profile from unloading successfully:
>>
>>svchost.exe (1036)
>> HKCU\Software\Microsoft\SystemCertificates\CA (0x1514)
>> HKCU\Software\Microsoft\SystemCertificates\Root (0x1528)
>> HKCU (0x152c)
>> HKCU\Software\Microsoft\SystemCertificates\trust (0x1554)
>> HKCU (0x1558)
>> HKCU\Software\Microsoft\SystemCertificates\My (0x155c)
>> HKCU\Software\Policies\Microsoft\SystemCertificate s (0x157c)
>> HKCU\Software\Policies\Microsoft\SystemCertificate s (0x1594)
>>
>>
>>
>>
>>
>>For more information, see Help and Support Center at
>>http://go.microsoft.com/fwlink/events.asp.
>>
>>"Gerry Cornell" > wrote in message
...
>>> http://www.eventid.net/display.asp?eventid=1517&eventno=1206&source=Userenv&phase=1
>>>
>>> More information e.g an exact copy of the Error Report from Event Viewer
>>> would be helpful.
>>>
>>> Make an exact note of the precise text of any error message. Minor
>>> discrepancies can
>>> make it harder to search for information about the error message.
>>>
>>> You can access Event Viewer by selecting Start, Administrative Tools,
>>> Event Viewer.
>>> When researching the meaning of the error, information regarding Event
>>> ID,
>>> Source
>>> and Description are important.
>>>
>>> A tip for posting copies of Error Reports! Run Event Viewer and double
>>> click on the
>>> error you want to copy. In the window, which appears is a button
>>> resembling two
>>> pages. Double click the button and close Event Viewer. Now start your
>>> message
>>> (email) and do a paste into the body of the message. This will paste the
>>> info from the
>>> Event Viewer Error Report complete with links into the message. Make
>>> sure
>>> this is
>>> the first paste after exiting from Event Viewer.
>>>
>>> In Event Viewer there is no facility to print Error Reports. A
>>> workaround
>>> is copy and
>>> paste the Error Report into an email, send it to yourself and print off
>>> the copy in your
>>> Inbox or your Sent Items folder.
>>>
>>> --
>>>
>>> ~~~~~~
>>>
>>>
>>> Hope this helps.
>>>
>>> Gerry
>>> ~~~~~~~~~~~~~~~~~~~~~~~~
>>> FCA
>>>
>>> Stourport, Worcs, England
>>> Enquire, plan and execute.
>>> ~~~~~~~~~~~~~~~~~~~~~~~~
>>> Please tell the newsgroup how any
>>> suggested solution worked for you.
>>>
>>> http://dts-l.org/goodpost.htm
>>>
>>> ~~~~~~~~~~~~~~~~~~~~~~~~
>>>
>>> "snowball" > wrote in message
>>> ...
>>>>I just have one problem created by the sp2 installation. I now get
>>>>event:
>>>>id 1517. constantly in event viewer for applications. Anyone else get
>>>>this
>>>>problem and resolve it without the use of UPHClean? Thanks.
>>>>
>>>
>>
>