Windows cannot unload your registry file. 11

[LCannon]

I have several Win 2K Pro machines that are all getting
the following error in the Event Log.

Event ID 1000
Windows cannot unload your registry file. If you have a
roaming profile, your settings are not replicated. Contact
your administrator.

DETAIL - Access is denied. , Build number ((2195)).

What I'm finding in Microsoft's knowledge base is to
install SP3, but SP3 is all ready installed. I'm thinking
that I'll just reinstall SP3 but I'm not sure that will
work. Any suggestions?

 

[stillnumber1]

I stopped the spooler service and this would resolve this issue as a temporary fix. I did find an article on Microsofts site. KB article 327984 your profile is not unloaded if you change printer setting and then log off. From troubleshooting this issue this is exactly the problem that I was having.

The only problem with the article at this time they do not list a fix but want you to call there tech support. So micosofts is aware of the problem but wants you to call and pay 245.00 dollars to resolve the issue instead of posting it on there website. That is very chessy I would say. If anyone has found a workaround please let us know. It seems that alot of IT professionals are having this issue.

 

[tbartels]

Anyone find a solution to this? I'm having the same trouble. SP3 installed, everything else seems to be updated.

 

[mikegsmith]

I followed up on tip about KB article Q814770 (not a public article). Do a google search on Q814770 and you will get two threads on microsoft.public.win2000.general.

Those threads suggested I call Microsoft Support, which I did. 1.800.936.4900. In the call I referenced Q814770 and 329170. No charge for the help. They gave me a case number and emailed a link for a fix, which I've downloaded but not yet installed. I was hoping the download would include a copy of Q814770 so I could confirm that the fix covered my situation, but the article was not included. So I called Microsoft again, and they emailed me a copy of Q814770. The following are excerpts from this article:

SYMPTOMS
========
When you log off your domain, it may take longer than you expect (a minute or more) for the operation to complete.

CAUSE
=====
This problem may occur if both of the following conditions are true:
- You have Windows 2000 Professional installed on your computer. -and-
- You install the update that is documented in the following Microsoft Knowledge Base article: 329170.KB.EN-US: MS02-070: Flaw in SMB Signing May Permit Group Policy to Be Modified This issue may be caused by a problem with the spooler service.

WORKAROUND
==========
To work around this issue, stop the spooler service before you log off your domain. To do this, follow these steps:
1. Click "Start", click "Run", type "cmd" (without the quotation marks), and then click "OK".
2. At the command prompt, type "NET STOP SPOOLER", and then press ENTER.

RESOLUTION
==========
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem. This fix may receive additional testing. Therefore, if you are not severely affected by this problem, Microsoft recommends that you wait for the next Windows 2000 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the "Time Zone" tab in the Date and Time tool in Control Panel.
Date Time Version Size File name
------------------------------------------------------
28-Jan-2003 13:34 5.0.2195.6659 45,840 Spoolsv.exe
STATUS
======
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

End of excerpts.

Because I can tolerate the workaround, I'm inclined not to risk this additional "fix" and just wait for SP 4.

 

[NoWittyName]

I had this on a few PCs on my network, disabled the Web Client service and all was well1

 

[renystro]

Hey, I've tried everything on this board and nothing worked...I even took off the 329170 fix, to no avail. Then I noticed that when I setup Netmeeting...it dies. If I tell Netmeeting not to start then it works again. I searched and found a MS article 327612. They have a post SP3 patch for this. I haven't installed it yet but they will give it to you free if you call them. (They just recomend you have a tape backup of your system - as always)

Good luck.

 

[Hondy]

MikeGSmith - Can you supply the link that Microsoft gave you for the fix?

My support people are supposed to have access to these articles (being MS specialists etc) but claimed they couldn't find them (??) which is why I never went down that route, but if you have the link I'll try the patch out and post the results

 

[mikegsmith]

Hondy: Sorry. I won’t and, effectively, can’t put the Q814770 “fix” into the public domain.

I won’t because this is a Microsoft product, which makes me inherently fearful of the mischief (and possible damage) it could do to folks’ computers. I’m happy to let Microsoft bear the sole responsibility (and liability) for this item. I have no intention of diverting any of that responsibility (or liability) to myself.

I can’t because the link to the hotfix is protected by a time-sensitive password, and my password has expired.

I’ve published the phone number and procedure for obtaining the Q814770 “fix” from Microsoft. It will take you less time to follow that procedure than it takes to log onto this forum, review new posts, and add a new reply. Go for it.

 

[uruiamme]

Okay, the Knowlege Base article is now PUBLIC on the Microsoft page. Here's the URL:

http://support.microsoft.com/default.aspx?scid=kb;en-us;814770

I am new to this thread and forum, but I have been seeing this issue since at least February. I will be trying to track it down on my newly installed w2k systems that I put hotfixes on. I was going to try the oh.exe program to see what it says.

I guess by now, everyone should understand that there are numerous Microsoft-admitted reasons for this error. Doing a simple KB search will only turn up a handful of them. I am probably seeing the Print Spooler problem fixed by the now (sort of) public 814770. I will try the tech support number and get the fix. (If memory serves me, however, I have gotten these sort of private fixes before with a brief e-mail exchabge to M$ tech support.) Of course, if the file shows up on a binary Newsgroup or something, that would be nice, too!

Tips on searching the KB: trying to search the KB for the keywords "userenv unload registry" or something you'd think would pick it up can be daunting. My best searches were for very specific phrase searches from the Event Viewer like "Windows cannot unload your registry file," keys showing up in the C:\WINNT\Debug\UserMode\userenv.log file "DumpOpenRegistryHandle," and the the keywords "Delay Log Off sp3."

 

[OutsourcedIT]

This is what I finally did that worked.

Unload file and printer sharing
Unload Client for Microsoft networks
Remove Q329170
Reboot
Load file and printer sharing
Load Client for Microsoft networks
(even if I did not need the above two services, I loaded them. You can always leave them un-selected in the adapter)

This fixed the startup shutdown problem and left me with a performance counter error that was fixed by running;
lodctr /r:c:\winnt\system32\perfstringbackup.ini

Now it boots with no errors.

Hope this helps somebody.

 

[Dave45auto]

Hello all, newbie here.

I saw this "slow logout" problem earlier and found a useful "workaround" at another web site. (I can't remember what the URL is though). Anyway the fix works at our company.

With an "admin" login, go to the W2K Administrative Tools, and add in the Local Computer Policy snap-in to access these registry items. The resulting tree view should start with Console Root -- Local Computer Policy. Navigate down through the tree to Computer Configuration -> Administrative Templates -> System -> Logon, and look for the "Maximum Retries to unload and update user profile" policy in the right hand panel. Double click to view the policy properties. Depending on your companies security configuration, this policy may or may not be enabled. Enable it and set the "Max Retries" value to 5 or less (seconds). Click the explain tab for more info on this policy setting.

When we instituted this policy, logoffs did not exceed 5 seconds, but roaming profiles could usually be retained.
Hope this works for you too.

 

[Dave45auto]

I just found the URL for the slow logout workaround I just posted. It is

<

http://www.eventid.net/display.asp?eventid=1000&source=userenv

>

watch out for the wrap.

 

[sanmonkey]

I'm experiencing the problem, tried several of the above suggestions (removed service pack, shared user profiles), however, I still get the error. I tracked down the SID of the userenv.log message to Protected Storage System registry key entry, and the following fix:

http://support.microsoft.com/?kbid=259416

This apparently has no effect on getting rid of the registry unload problem, but did help some with a dial-up password problem I was having.

 

[skeeterlogan]

Thanks to &quot;OutsourcedIT&quot; for the peripheral comment about &quot;This fixed the startup shutdown problem and left me with a performance counter error that was fixed by running;
lodctr /r:c:\winnt\system32\perfstringbackup.ini&quot;. I was getting &quot;EVENT ID: 3000 and 3011 / Source: LoadPerf&quot;. Your fix for your performance counter error cleaned up both of these Events. Thanks again.

 

[davemac05]

Hi

I found this on the MS site

http://support.microsoft.com/default.aspx?scid=kb;en-us;319909

I have sp3 but not the hot fix, but starting the IPSec Policy agent seemed to do the trick.

 

[sanmonkey]

Fixed my registry unload problem by removing BOTH Q329170 and Q328310, thanks to this tip:

http://groups.google.com/groups?hl=...6e850b.0304071541.529a6eee@posting.google.com

 

[xmasam]

&quot;Saving settings&quot; during shutdown took 1 minute and error event ID 1000 got generated. The reason was disabled VirusScan 7.00.5 before shutdown. When it is enabled it takes no more then several seconds...

 

[socialstudy]

Hey xmasam, your post is the only one I've seen that mentions VirusScan 7.00.5. I find it interesting because I only started to experience the slow shutdown and registry unload problem after I installed an anti-virus application (Norton AV 2003 Pro). I had SP3 and all of the latest hotfixes installed before the AV install and the system was working perfect. I installed Norton AV and the problem started. First thing I did was disable floppy scan in Norton AV. Then I uninstalled Q329170 and Q328310. Still had the problem and contacted Symantec for support. They had me check a few things and then uninstall Norton AV and all symantec apps to see if it was a symantec issue. The problem continued. I'm still having this problem and I've tried the disabling the net print services as suggested and changing the &quot;maximum retries to unload and update user profile&quot; to 5. Nothing is working. Only things left to do (I think) are to remove hotfixes one at a time and then SP3 or reinstall Norton AV to see if it corrects the problem. Anyone else have any ideas?

 

[DerekGTRI]

I'm new to this site and just wanted to say THANKS!!! I work for a research facility and we use Win 2000 on all of our PC's. I noticed recently that I've been getting this same error and I knew it had something to do with the Windows Updates. Up until today, I have been doing complete re-installs of Win 2000 to fix the problem if I couldn't get rid of it through other means. But now I actually have some possible solutions, which helps more than you know. Thanks again!

 

[ddowd]

RE Event 1000

Have You changed any permissions on your root drive default share they should be set by default to allow only(everyone) Full Access, if you set the Drive Security Back to allow everyone full control (drive properties\security)
this will work

 

[Athena02116]

I thought I'd post this up - hopefully this will assist some people and stop others (like myself) from banging their heads against the wall. sigh.

I spent over 4 hours on the phone with a MS Tech troubleshooting this issue. I have had this problem (slow shut downs/Event ID 1000 entries in Event Viewer) with three brand new Dell laptops recently - Two with Win2K SP3, One with Win2K SP2. I noticed that none of these machines had errors/problems until I downloaded the MS updates.

Soooo..to make a very long story short, the download for Root Certificates under the Windows 2000 category is the offending download. Of course, there is no uninstall for this component. All critical updates were installed without issue. I'm waiting for the MS Tech to respond to my email with this info. If I find a way to solve this without a reformat/rebuild, I'll post it asap.