Microsoft Windows User Profiles Service Event 1530

Microsoft Windows User Profiles Service Event 1530

This topic describes event 1530 from the User Profile Service

Applies to: Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008

Event Details

Product

Microsoft Windows Operating System

ID

1530

Source

Microsoft-Windows-User Profiles Service;

User Profile Service

Version

6.3, 6.2, 6.1

Symbolic Name

EVENT_HIVE_LEAK

Message

The Windows operating system detected that your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

Included in the following details are four examples of the type of information that can appear in this event message:

1 user registry handles leaked from \Registry\User\S-1-5-21-3112862306-1016156048-4130204762-1000: Process 932 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3112862306-1016156048-4130204762-1000

1 user registry handles leaked from \Registry\User\S-1-5-21-4211544788-2274021965-2216582883-1001_Classes: Process 3568 (\Device\HarddiskVolume3\Windows\System32\WUDFHost.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001_CLASSES

5 user registry handles leaked from \Registry\User\S-1-5-21-4211544788-2274021965-2216582883-1001: Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-

4211544788-2274021965-2216582883-1001

Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37 ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001

1 user registry handles leaked from \Registry\User\S-1-5-21-4211544788-2274021965-2216582883-1001: Process 2492 (\Device\HarddiskVolume3\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001\Software\Microsoft\Windows\CurrentVersion\Explorer

Cause

This event can be caused by apps that do not release their Registry keys before shutting down. This most often occurs when an app runs in the background and does not release its Registry keys when a user signs off, in which case Windows forces the Registry to unload. There is no impact to users, though in rare cases recent configuration changes in the app might not be saved.

Resolution

No user action is required - this is an acceptable condition.

In Windows 8.1 we changed this to an Information message to help reduce confusion and alarm. This event was a Warning event in prior versions of Windows.

Related Information

 
Sort by: Published Date | Most Recent | Most Useful
Comments
  • re: "Event ID 1530 is logged as a Warning event. The application that is listed in the event

    detail is leaving the registry handle open, and it should be investigated."

    What do you mean by "should be investigated."?  Invetigate, how?

    Thank you.

  • If this is a "NORMAL" condition then why the hell is it a warning in the logs,  there's already enough crap in there without tracking down normal ***.

  • Like others here I'm chasing down non existent proplems; and that's us imagine how many don't get this far......

  • The 3 remarks above me are very sarcastic,I was gonna leave 1 myself but looks like you 3 covered all the bases!

  • Thanks...No user action required-this is a normal condition..this is all I needed to read to put my mind at ease...

  • A warning that is a normal action...did  I read that correctly?

  • Thanks for your feedback – we understand that this event is causing confusion (and frustration!). For now, hopefully this article (and our rewritten Cause section) helps; we’re also investigating what we can do to improve this event in the future.

  • This error also caused the user profile to fail to load.  The error message refers to registry handle leaks.

  • Yes, indeed, users are unable to log in when this event occurs, because the user profile fails to load.

  • Your arrogance and elitism precludes you from any improvements.

Page 1 of 2 (18 items) 12