Windows cannot unload your registry file. 11

[LCannon]

I have several Win 2K Pro machines that are all getting
the following error in the Event Log.

Event ID 1000
Windows cannot unload your registry file. If you have a
roaming profile, your settings are not replicated. Contact
your administrator.

DETAIL - Access is denied. , Build number ((2195)).

What I'm finding in Microsoft's knowledge base is to
install SP3, but SP3 is all ready installed. I'm thinking
that I'll just reinstall SP3 but I'm not sure that will
work. Any suggestions?

 

[Bulk]

I am getting the same thing. I also have SP3 loaded. I was not having this problem until I loaded the latest security patches for W2k including IE6 cumulative patch.

Does anyone have any ideas on how to resolve this?

You can't uninstall most of the security patches so that does'nt seem like a reasonable answer. I have read something about OH.exe being able to identify the key in the registry that is hanging but I do not know anything about OH.exe

Thanks in advance.

 

[netwalker1]

I read something about this issue before , Hmm , Let me see ,, Here u are ,, check this link :

http://archives.neohapsis.com/archives/ntbugtraq/2002-q1/0090.html

Mohamed Farid
Know Me No Pain , No Me Know Pain !!!

 

[netwalker1]

And I found now another site :

http://www.jsifaq.com/SUBE/tip2100/rh2199.htm

Check it too , I think It also may help ! Mohamed Farid
Know Me No Pain , No Me Know Pain !!!

 

[Bulk]

Thank you for the responses. I believe these sites refer to people that are using roaming profiles. I neglected to make clear that I am not using a roaming profile.

Funny thing is that I just loaded another machine fresh with W2K and SP3. As soon as I loaded the IE6 cumulative patch and latest security patches I started having the same problem on that machine.

If no one else is having this problem it must be something I am doing. Only time will tell. In the mean time I will wait out the 60 second delay on shutdown.

Thanks again,

Bulk

 

[jasonboyes]

I have had this problem with a PC administrator account and have not resolved it yet. (I just lock the screen and do not log out)
I am not sure where the problem lies


Jason Rich Cook -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning."

 

[Bulk]

I fixed my problem. Please see the seperate post titled "SLOW SHUTDOWN FIX!"

 

[Strator]

thread616-437790

 

[KennyLD]

I have got a clue:
If I go to to Administrative Services > Services, and close the Print Spooler service then Windows shuts down normally!

So what does this have to do with "saving settings" I don't know, but I hope someone else does.

 

[Yooper46]

I have this exact same problem now that I have downloaded all updates on a new W2K server. Has anyone come up with a solution here? I tried to find the separate post title Slow Shutdown Fix but could not seem to find.

TIA

 

[Yooper46]

Found the Slow Shutdown Fix and it corresponds exactly to when my system slowed down. Thanks for that post! I will fix immediately when I get to work on Monday.

It does not correspond to the date that I started receiving Event ID 1000, however, which was a month ago.

Have anyone found any solutions since this thread was stared.

TIA

 

[JoeMon]

The thread mentioned in by Strator (thread616-437790) worked for me and is well marked with stars, so it must have worked for others. Did you give it a try?

 

[GaryRumson]

Symptom: 60 seconds additional delay in shutting down or logging off Win2K. The problem is described under this heading already, but it is appearing again (apparently) as a result of Win2K critical update Q329170, 12 December 2002. Work-around is as already noted:
Run gpedit.msc. In local computer policy, change "Maximum retries to unload and update user profile" to far less than its default 60. Find this setting under Group Policy Editor > Local Computer Policy > Computer Config > Admin Templates > System > Logon. I set mine to 5 tries (5 seconds).


This will work

 

[TBoxz2000]

Had same problem (Win2k/SP3 + Novell Client 4.83/SP1)
Uninstalling hotfixes was no option, tried net spool stop and ik worked!
Made script, put it in User Logon/off via gpEdit.msc and all's fine now!

 

[BekendeVlaming]

Have the same problem, but only with certain (non-roaming)accounts. Very weird indeed. You could create yourself a new account to get rid of the timeout (for those who can, home users, ...), but you'll loose all your registry settings. It's a small price to pay. Switching to a new account once in a while also keeps it fast. Hope it works for you too.

 

[skeeterlogan]

I'm running Windows 2000 Server on a Dell Poweredge 4600.
My recent history with this problem (and fixes) follows:

Taken from a tip from "EventID.Net":
"Open the MMC and add the Group Policy snap-in, then open the Group Policy editor. Go to Computer Configuration/Administrative Templates/System/Logon and find the policy "Maximum retries to unload and update user profile." Do not click "Disable" nor "Not Configured" as that just will use the default of 60. Rather, lower the # of tries to unload downward from 60. I figured, "If you can't unload it, don't bother trying", so I set mine to 0 and shutdown is (finally!) instantaneous once again".

Okay...I did this AND:
&quot;When a user logs on, that part of the registry is loaded as &quot;HKEY_CURRENT_USER&quot;. When a user logs off, the HKEY_CURRENT_USER is &quot;unloaded&quot; and saved on the hard disk &quot;NTUSER.DAT&quot; under &quot;Documents and Settings\<user name> directory for a local profile or on the network for a roaming profile. So what can stop this process? As far as we can see there are 2 possibilities:
1. The registry is not accessible. If an application locks the registry then Windows cannot properly &quot;unload&quot; HKEY_CURRENT_USER (to make sure that all the settings are saved). A couple of Q articles listed here (Q269858 for example) point to such situations where rogue apps lock the registry even though they should gracefully release it during a logout or shutdown.
2. The registry is ok but there are problems with the location on the hard disk for the &quot;NTUSER.DAT&quot; file. &quot;Problems&quot; usually means the location is not available (i.e. network issues for roaming profiles) or the user does not have enough rights (Full Control right is required for this operation. See Q255113 for an example of it.
So, based on the information above, we would make sure that the user has Full Control to the location of the NTUSER.DAT file and if that's ok, then try to identify the rogue application (this may be a bit tricky - try only loading one app at a time and logout). In any event, apply the latest service packs for the OS and the application installed on the system.&quot;

Well...that fixed it until I recently installed 2 critical updates from Microsoft:
811630: Critical Update (Windows 2000) AND
810847: February 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1

Now...its back to Event ID 1000 / Source:Userenv
&quot;Windows cannot unload your registry file.....&quot;

Any suggestions out there??

 

[skeeterlogan]

Thanks to &quot;Strator&quot; who posted the answer to this (in a different thread). Its essentially uninstalling M/S Hotfix Q329170. Hopefully Microsoft will fix this before (and NOT include this with) Service Pack 4). This not only fixed Event Id 1000 from occuring (&quot;Windows cannot unload your registry file&quot but also fixes the slow exit of a logoff or shutdown. With congratulations to &quot;Strator&quot;...his answer as quoted:

&quot;Maybe I have a solution for you, because I have experience from the same problem (stalling at &quot;saving settings&quot
I did not accept the &quot;saving settings&quot; delay, (I had a shutdown time of approx 1minute+ too) so I did a fresh install of my w2kpro (sp3-slipstreamed) to find out. Earlier I tried to solve it by changing AV program and uninstalling various programs with no results.
I started to apply all of the hotfixes from windowsupdate, one by one.
When I finally installed a hotfix called: q329170, I ran in to the same problem as before, (loooong delay on Shutdowns and Logouts)
Also I had an error in the Log, caused by &quot;Userenv&quot; and the Event ID was: 1000. &quot;Unable to delete your registryfile from memory&quot; it said.
More info on the hotfix is here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;329170

In my case I solved it by a uninstall of the hotfix until I know a better, because it wasn't a critical hotfix for me.&quot;

 

[Yooper46]

How do you uninstall a hotfix when it says other hot fixes and programs might not run? I tested removing a hot fix on my local workstation with W2K on it and hosed the OS. I am afraid to try this on our server which serves as a data storage for 25 people. Do you have to uninstall all hot fixes in the order which they were installed to get to the one you want? Any help appreciated. TIA

 

[skeeterlogan]

Just go to &quot;Add/Remove Programs&quot; in the Control Panel and do it from there. Uninstall ONLY the Q329170 Hotfix. And yes, I got the warning too about other programs possibly not working, but went ahead and uninstalled it anyway. This was on a Dell Poweredge 4600, dual Xeon 2.4Ghz processors with 2Gig of RAM running Windows 2000 Server. It serves as the Primary Domain Controller, and DNS Server for 2 departments at a telephone company. I also uninstalled it on a Windows 2000 Professional Workstation (Dell Precision 530 workstation, dual processor, 2Gig RAM)as well with no ill effects. If you're running the automatic &quot;Windows Update&quot; program, it will come back and tell you that the update needs to be installed (again), but just uncheck it and it will go away.

 

[kayss]

I was having this same problem, but something about uninstalling a hotfix didn't ring true to me. One of the things I had changed recently was to disable several services that I didn't think I needed (as instructed by some Win2k tweaking guides I found on the Web).

One of the services I disabled was Remote Registry Service. Since this is a registry access error, I figured I'd try enabling the Remote Registry Service again. I set it to manual and started it, then rebooted. The computer rebooted in less than 10 seconds. I have a feeling the service needs to be set to automatic, as I just looked and when set to manual the service does not get started up by Windows automatically.

Hope this helps.