Windows cannot unload your registry file. 11

[LCannon]

I have several Win 2K Pro machines that are all getting
the following error in the Event Log.

Event ID 1000
Windows cannot unload your registry file. If you have a
roaming profile, your settings are not replicated. Contact
your administrator.

DETAIL - Access is denied. , Build number ((2195)).

What I'm finding in Microsoft's knowledge base is to
install SP3, but SP3 is all ready installed. I'm thinking
that I'll just reinstall SP3 but I'm not sure that will
work. Any suggestions?

 

[Athena02116]

Update to the last post: The problem happens when Q323172 & Q324096 are downloaded along with the Root Certificates install. Uninstall these two hotfixes and see if this helps get rid of the slow shutdown/Event ID: 1000 messages. It worked for me.

 

[ashok000]

Hello,

As it has been stated by the all the posts the userenv error regarding the the problem to unload the registry is caused by many things. I thought i post this as one of the solutions to this problem (it might not solve it for your cause thought but give it a try). We had the same problem as well and in our case we used TightVNC software. Having gone through enless articles and forums i came a across a an forum in

http://www.eventid.net

(

http://www.eventid.net/display.asp?eventid=1000&source=

)
about various people having this problem. It turns out that one of the people suggested taking off TightVNC (uninstalling). This cured our problem and it sorted out the slow logoff problem as well.

So my advise to you is that if you are experiencing this problem and that you use TightVNC - uninstall the TightVNC and install the latest version of RealVNC which is a similar program but is corrected so it does not cause this problem.

The credit goes to one of the user who remained anonoymous in the URL i have stated above. Check it out and hope it sorts out your problem.

 

[rosieBsDad]

Hello All,

I have a new twist to this problem. Been bugging me for about two months on and off, but finally cracked my problem this morning.
Nothing (directly) to do with any of the Security updates or SP level (running SP3, fully patched as of end of May 2003).

My problem was the Logitech iTouch support software for the Internet keyboard. The clue to tracking it down was the userenv.log file in full verbose debugging mode. (See Q221833 - set the hex value to 30002). Right at the start of the file it showed three references to itouch.exe

I uninstalled iTouch and BINGO - back came my quick logout and roaming profiles work again.

Hope this helps someoen else.

S

 

[NoidCyber]

Thanks to this thread !!!

I fixed my error by removing the hotfix called: q329170

Thanks again.

 

[JHammy]

Let me take the opportunity of thanking "rosieBsDad" and send an expert post mark in your direction.

I have been following this thread (as a non member) for weeks now, taking note of the considerable professional advice all users have taken to trying to weed out this problem.

I have been one of the unfortunate users that have suffered even more greatly due to this error. Every ten or so times I have tried to shutdown, my Windows registry corrupts itself.
" Windows 2000 could not start because the following file is missing or corrupt:
\WINNT\SYSTEM32\CONFIG\SYSTEMCED "

I have now rebuilt the registry 12 times and my entire machine 3 times.

I have tried removing the obvious Q329170 and applying various registry tweaks to increase shutdown time to allow correct unload, but to no avail.

After spending last night following "rosieBsDad" advice, I have also found that Logitech ITOUCH is the cause of all my woes. Having uninstalled, I have now resolved all my pc problems, and have NO need to unload any Microsoft security fixes.

I have also contacted Logitech and informed them of this problem.

regards
J.
X-)

 

[stillnumber1]

I fixed this issue by calling Microsoft. They gave me a patch that resolved this issue. Fix for Microsoft Knowledge Base article number Q814770

I installed this patch and it resolved the issue. Also the call to Microsoft was free of charge. They just have not released this patch to the public as of yet.

 

[rosieBsDad]

Thanks to JHammy" for the appreciation!

Ironically, I got onto Logitech's site this morning to check it out further (and report it) and blow me! there's a support document already there.

However, please be aware that their workaround of manually stopping iTouch.exe fixes the slow logout problem, but if you're using roaming profiles as well, they still don't get written back.

I used the MS oh.exe program (try "oh itouch" from the command line)and have proven that even logging out as a user does NOT release several registry keys, they stay open even if you log in as a different user (which means the problem could "propogate&quot. The only way to stop the issue is to stop iTouch loading at all - which kinda defeats the object of buying a sexy keyboard for lazy Internet use!

Good luck to all you slow logout people....

RosieBsDad

 

[NoidCyber]

stillnumber1 :::::

That article number doesnt exist. (I did a search)

Maybe you could post a link?

 

[JHammy]

I just received an email back from Logitech this morning and suprise suprise it pointed me to the FAQ.

It looks like all the logitech radio keyboard users will have to wait a little longer.....

http://www.logitech.com/index.cfm?p...&showalldocuments=0&countryid=18&languageid=1

regards

J.

 

[DerekGTRI]

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q814770

 

[NoidCyber]

thx....

how odd... that I didnt find it....

 

[NoidCyber]

hey now ... thats not a fix...

its a workaround ... and if you want the fix ... you have to call them and pay

(I do anyway)

 

[maxwelldone]

rosieBsDad's Logitech iTouch fix (if you want to call removing all of Logitech's software a fix)worked perfectly! Another star for rosieBsDad!
mike

 

[stillnumber1]

Noid cyber if you are having the same issue that I describe you need to call Microsoft in order to get this issue resolved they have a hotfix that for some reason they are not releasing to the public. But this does fix the issue. The call did not cost us anything and they will give you the information on how to get the hotfix. For some reason they dont want to release it to the public. I would try installing service pack 4 that just came out today. They may have added the fix to service pack 4.

 

[stillnumber1]

The fix is a part of Service pack 4 I just checked. Here is a link to the site. It is listed as a printer issue an 814770 is the number. So download Service pack 4 and it should resolve this issue. Well it is about time. After almost a whole year.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;327194

 

[MountainNetworks]

I am using roaming profiles. To make life more interesting, i'm loading roaming profiles over a VPN type of WAN. Screaming yet? All my workstations function fine. Workstations in the same office as the domain controller can use their roaming profiles just fine, and all of the computers at the remote facility can operate just fine too....

...All but one! One rebellious workstation. All workstations run Windows 2000 Pro. On this one stubborn workstation I have just loaded SP4 to no avail. Whenever this one user logs on to this one workstation, it refuses to load her roaming profile. She isn't even given the choice.

In summary... One user on just this one workstation, can't load her roaming profile. She can load her roaming profile just fine on any other workstation in the remote office. What's the deal? I've tried every fix I know of to get rid of that Userenv "can't unload registry" error. Nothing works. Any ideas?

Thanks

 

[friar]

Like almost everyone else, the advice to uninstall Hotfix Q329170 solved the problem for me. No slow logouts and no event id 1000.

Now we have deployed SP4 and the problem is back! Anyone else with the same problem and (hopefully) solution?

Thx

 

[Maagen]

Hi

I have the same problem as "friar". I had a Windows 2000 server with Terminal Services, with no problems at all. Then I installed SP4 - and geuss what.... Now I'm looking for a solution for the problem with event id 1000 and slow logoffs...

I have noticed that if the spooler service is stopped there is no problems. I just can't have the spooler service stopped since it is a terminal server with other users...

 

[DDILL]

Here goes...
I have been working this problem for some time and can hopefully shed some light on the symptom and its relation to certain issues. The general issue being discussed here is that it takes 60 seconds to log off. The reason for this is, as many issues above show, the unloading of the user's profile failed and the default wait time is 60 seconds and then give up. This failure to unload the profile however could be from any number of reasons. Mine is with Microsoft RPC vulerability patch 823980 install MS03-026. You need to locate the registry key that is being locked and the process that is locking it. I used process explorer from sysinternals to find the problem with mine. To find the key that is locked you can open regedit and under hkey-users there will most likely be a SID key missing its pair. That is the locked profile. Now if it the SID_classes key that is the usrclass.dat file or the SID key that is ntuser.dat. Anyway, you ill not be able to delete locked keys. In my case msiexec held open the SID_classes root key so it was the only key I could not delete or had nothing under it. You need to find the correct key (lowest in the structure that can not be deleted. Now find the owner of that handle.
Issues known to hold the profile in a locked state, MS03-026, Some HP print drivers, Anti-Virus, third party applications that don't close handles properly, etc.

Long story short. These symptoms are vague and can be anything. Try to look deeper.

My problem MS03-026 with Citrix and HP Color LaserJet 4500 PCL6, and other unidentified drivers all together.

Good luck to all and hope this info helps somebody.

 

[fgastald]

This message is for DDILL and all the people experienced the same problem.
Hello,
i get the same problem of yours, so how did you manage this problem?
Which registry key did you delete?
Thanks in advance for the kindly help
Fabio