locked
Getting 1530 User Profile Service errors in eventviewer RRS feed

  • Question

  • Hello,

    Since a few weeks i have been getting the 1530 User Profile Service warnings in my eventviewer:

    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

     DETAIL - 
     1 user registry handles leaked from \Registry\User\S-1-5-21-2980117219-1486898219-2041705551-1000:
    Process 3028 (\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe) has opened key \REGISTRY\USER\S-1-5-21-2980117219-1486898219-2041705551-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl

    Before this started i did not install nothing new or update anything.

    Things i have done:

    Checked HDD for errors: None 

    checked for virusses and spyware with Avast and MBAM: None detected

    Checked my RAM: no errors came up.

    i have no idea what is causing it or how to fix it so i hope someone here can help me. Thanks in advance.

    Thursday, December 5, 2013 3:04 PM

Answers

  • Hi,

    I agree with Theantioch.

    In addition, generally speaking, event ID 1530 means there are some data in the user profile are still be accessed when the user logoff from the Terminal Server, you have very possibly enabled the policy to remove the user profile when logged off. In such a situation the error appears. To troubleshoot this error, you can check if any of the data is still remained in the user profile supposed to be deleted. That should be the data the process is using when logoff happens. You can use Process Monitor or Process Explorer in order to find the software which is using the data and find the solution. If there is no such data remained, the Windows have possibly stopped the process and deleted the data when logoff. In such a case, you can ignore the Event 1530.

    Regarding EventID 1530, please also take the following KB article as reference:

    Event ID: 1530 may be logged in the Application log on a Windows 7-based or Windows Vista-based client computer

    http://support.microsoft.com/default.aspx?scid=kb;EN-US;947238

    Event ID: 1530 may be logged in the Application log on a Windows Vista or newer computer

    http://support.microsoft.com/kb/947238/en-us

    Hope it helps.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    • Marked as answer by Cloud_TS Monday, December 23, 2013 6:59 AM
    Monday, December 9, 2013 1:35 AM

All replies

  • This is pretty common, there are numerous fixes available. With a quick google search I found this: http://answers.microsoft.com/en-us/windows/forum/windows_7-security/event-id1530-microsoft-windows-user-profiles/a1ca9fd0-5449-46b6-aae2-35e3edcf8425 This involves making some modifications to your registry, which if your not experienced can cause some massive issues. I would recommend that unless this is affecting something your doing within windows to just leave it be. This is classed as a warning, but this is normal behavior for windows 7 / vista.

    Thursday, December 5, 2013 6:31 PM
  • Hello,

    Thanks for the fast reply.

    So i can just ignore this warning?

    since i will not go arround changing stuff in my registry because i find that quite risky to be honest.

    • Edited by Raigara Friday, December 6, 2013 10:51 AM
    Friday, December 6, 2013 10:51 AM
  • Hello,

    Thanks for the fast reply.

    So i can just ignore this warning?

    since i will not go arround changing stuff in my registry because i find that quite risky to be honest.

    That's what I would do. If I can see lots of people discussing the problem and indicating it is not a symptom of anything more sinister, I wouldn't bother. Often times the fix for something like this is more problematic and causes more issues then just dealing with it. In this case its expected windows behavior so you may not be able to fix it no matter what you do.
    Friday, December 6, 2013 5:24 PM
  • Hi,

    I agree with Theantioch.

    In addition, generally speaking, event ID 1530 means there are some data in the user profile are still be accessed when the user logoff from the Terminal Server, you have very possibly enabled the policy to remove the user profile when logged off. In such a situation the error appears. To troubleshoot this error, you can check if any of the data is still remained in the user profile supposed to be deleted. That should be the data the process is using when logoff happens. You can use Process Monitor or Process Explorer in order to find the software which is using the data and find the solution. If there is no such data remained, the Windows have possibly stopped the process and deleted the data when logoff. In such a case, you can ignore the Event 1530.

    Regarding EventID 1530, please also take the following KB article as reference:

    Event ID: 1530 may be logged in the Application log on a Windows 7-based or Windows Vista-based client computer

    http://support.microsoft.com/default.aspx?scid=kb;EN-US;947238

    Event ID: 1530 may be logged in the Application log on a Windows Vista or newer computer

    http://support.microsoft.com/kb/947238/en-us

    Hope it helps.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    • Marked as answer by Cloud_TS Monday, December 23, 2013 6:59 AM
    Monday, December 9, 2013 1:35 AM