none
registry handles leaked from

    Question

  • + System
       
    - Provider
          [ Name] Microsoft-Windows-User Profiles Service
          [ Guid] {89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}
          [ EventSourceName] profsvc
       
    - EventID 1530
          [ Qualifiers] 32768
       
      Version 0
       
      Level 3
       
      Task 0
       
      Opcode 0
       
      Keywords 0x80000000000000
       
    - TimeCreated
          [ SystemTime] 2011-06-11T07:37:12.000Z
       
      EventRecordID 127007
       
      Correlation
       
    - Execution
          [ ProcessID] 0
          [ ThreadID] 0
       
      Channel Application
       
      Computer Panther-PC
       
    - Security
          [ UserID] S-1-5-18
    - EventData
    Detail

    16 user registry handles leaked from \Registry\User\S-1-5-21-1082989139-2594333343-3947924465-1001: Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001 Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001 Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001 Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001 Process 828 (\Device\HarddiskVolume1\Program Files\NVIDIA Corporation\nTune\nTuneService.exe) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001 Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\My Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\CA Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\Root Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\SmartCardRoot Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\TrustedPeople Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\trust Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Policies\Microsoft\SystemCertificates Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Policies\Microsoft\SystemCertificates Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Policies\Microsoft\SystemCertificates Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Policies\Microsoft\SystemCertificates Process 2384 (\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1082989139-2594333343-3947924465-1001\Software\Microsoft\SystemCertificates\Disallowed

     

     

    should i be worried or can i get some help with this ?


    Saturday, June 11, 2011 12:24 PM

Answers

  • Hi,

    This is by design.

    Please refer to http://support.microsoft.com/kb/947238.

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Wednesday, June 15, 2011 9:10 AM
    Moderator

All replies

  • Hi,

    This is by design.

    Please refer to http://support.microsoft.com/kb/947238.

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Wednesday, June 15, 2011 9:10 AM
    Moderator
  • Hi,

    I know, that this is a bit old post, but I have a problem related this error. In our company, there are two domains. The users can browse through the other domain. When a user logs in to the other domain, In Vista, and Win7 the OS is throwing away the other login after a while, and interrupts the connection. What can I do against this?

    Wednesday, November 07, 2012 2:49 PM
  • I'm having the same problem on one of work's Server 2008 R2 machines, but the software causing the leaks are the Microsoft Windows programs

    • cmd.exe
    • robocopy.exe
    • conhost.exe

    Microsoft can you please stop your software from leaking, thank you.

    From the event viewer

    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

     DETAIL -
     6 user registry handles leaked from \Registry\User\S-1-5-21-3799963273-679199981-738785089-500:
    Process 2348 (\Device\HarddiskVolume2\Windows\System32\cmd.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500
    Process 6532 (\Device\HarddiskVolume2\Windows\System32\Robocopy.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500
    Process 2348 (\Device\HarddiskVolume2\Windows\System32\cmd.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500\Software\Microsoft\Windows NT\CurrentVersion
    Process 2348 (\Device\HarddiskVolume2\Windows\System32\cmd.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500\Control Panel\International
    Process 6700 (\Device\HarddiskVolume2\Windows\System32\conhost.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500\Control Panel\International
    Process 6532 (\Device\HarddiskVolume2\Windows\System32\Robocopy.exe) has opened key \REGISTRY\USER\S-1-5-21-3799963273-679199981-738785089-500\Control Panel\International


    Tuesday, January 15, 2013 2:28 AM