EventID: 1530 User registry handles leaked

Question

question

SalimHurjuk asked Nov 7, '20 JoyQiao-MSFT commented Nov 17, '20

EventID: 1530 User registry handles leaked

After user logoff, the error observed in the event viewer.

Log Name: Application

Source: Microsoft-Windows-User Profiles Service

Date: 07-11-2020 21:57:29

Event ID: 1530

Task Category: None

Level: Information

Keywords:

User: SYSTEM

Computer: Server.Domain.com

Description:

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.

DETAIL -

10 user registry handles leaked from \Registry\User\S-1-5-21-3948394408-3063370748-2683190124-1436:

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore\Parents

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore

Process 1524 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Main

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Policies\Microsoft\Internet Explorer\Main

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore\Children

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Security

windows-server-2016

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2020-11-07T19:26:17.027Z

DSPatrick answered Nov 7, '20 SalimHurjuk commented Nov 7, '20

Something here might help.
https://support.microsoft.com/en-us/help/947238/event-id-1530-may-be-logged-in-the-application-log-in-windows

--please don't forget to Accept as answer if the reply is helpful--

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SalimHurjuk · Nov 07, 2020 at 08:05 PM

How to investigate this issue?

0 ·

Answer 2 · 2020-11-07T20:08:26.247Z

DSPatrick answered Nov 7, '20 SalimHurjuk commented Nov 7, '20

How to investigate this issue?

I'd start with the process IDs. Task Manager\Processes. Also try from a clean boot.
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

--please don't forget to Accept as answer if the reply is helpful--

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SalimHurjuk · Nov 07, 2020 at 08:10 PM

This is WS2016 uses as a master image in Citrix Provisioning Service

0 ·

Answer 3 · 2020-11-07T20:22:22.06Z

DSPatrick answered Nov 7, '20

This is WS2016 uses as a master image in Citrix Provisioning Service

This forum focuses on the operating system itself. You could ask for help with Citrix Provisioning Service here in dedicated forums
https://discussions.citrix.com/forum/1358-provisioning-server-for-desktops/

--please don't forget to Accept as answer if the reply is helpful--

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2020-11-08T05:06:36.87Z

SalimHurjuk answered Nov 8, '20

This Event is based on Microsoft-Windows-User Profiles Service

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 5 · 2020-11-08T13:32:04.997Z

DSPatrick answered Nov 8, '20

This Event is based on Microsoft-Windows-User Profiles Service

Yes, I'm aware. I'd start with the process IDs responsible. Task Manager\Processes.

--please don't forget to Accept as answer if the reply is helpful--

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 6 · 2020-11-09T06:25:43.05Z

JoyQiao-MSFT answered Nov 9, '20 JoyQiao-MSFT commented Nov 17, '20

Hi,

Thank you for coming Microsoft Q&A.

We noticed you encounter an expected waring event log which caused as Windows automatically closes any registry handle to a user profile that is left open by an application.

According to Microsoft states, starting with Windows Vista, the User Profile Service will force the unloading of a user profile when that user logs off. This is a situation where the functionality of forcing the unload of the user profile may break an application if registry handles are not closed in the process. This new User Profile Service functionality is the default behavior. (Source: A COM+ application may stop working in Windows when a user logs off)

We could try the resolution recorded in that source article to enable group policy Do not forcefully unload the user registry at user logoff policy which is located under Computer Configuration > Administrative Templates > System > User Profiles.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JoyQiao-MSFT · Nov 17, 2020 at 09:17 AM

Hi,

I would like to know if my information in previous reply is useful for you.

If yes, would you accept it as answer.
If no, please reply to us at any time if you need further assistance.

Bests,

1 ·

question