Windows Legacy OS forum

General discussion

Event Viewer Warning ?

by glenn30 / January 25, 2006 12:37 AM PST

Win XP Pro SP-2 and all critical updates.

Each day on closing I am finding an event viewer warning. Question is what is it and what do I do about it? Google found a reference of this indicating something is not shutting down before Windows closes. Here is an image from ImageShack. Never used before... hope it works:

Thanks for any help in correcting the problem and eliminating the daily warning.


Discussion is locked
You are posting a reply to: Event Viewer Warning ?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Event Viewer Warning ?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
What's failing?
by R. Proffitt Forum moderator / January 25, 2006 1:15 AM PST
In reply to: Event Viewer Warning ?

Warnings are such, but we need a failure to close in on the issue.


Collapse -
You Can
by Darton Fury / January 25, 2006 2:53 AM PST
In reply to: What's failing?

R-click the entry and choose Properties for a full explanation.

Collapse -
Thanks for the information.
by glenn30 / January 25, 2006 3:51 AM PST
In reply to: You Can

The properties explanation is:

''Windows saved user (my identification) registry while an application was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be uploaded when it is no longer in use.''

I see the gist of the problem but do not have the skills to locate the application that is still running during log off when the user information was saved by windows. If I knew how to isolate this then corrective steps could be taken... maybe! Advice or recommendations from anyone having knowledge of this warning is appreciated. To me this seems an abnormal shutdown.

Thanks again,


Collapse -
Nothing failed.
by R. Proffitt Forum moderator / January 25, 2006 5:15 AM PST

Since nothing failed, what is to be fixed?


Collapse -
(NT) (NT) Then why the warning?
by glenn30 / January 25, 2006 5:21 AM PST
In reply to: Nothing failed.
Collapse -
Read the warning.
by R. Proffitt Forum moderator / January 25, 2006 5:51 AM PST

Read the warning..

There are some that wany a PERFECT EVENT VIEWER. If so, be sure to hit and see if others have seen this one.

But without a FAILURE, it's best to sit back and do a little research. I'd look hard if you could supply some failure or anomalous behaviour. But as it stands there is nothing to fix since the message tells you what windows will do as it shuts down or logs out.

"The memory used by the user's registry has not been freed. The registry will be uploaded when it is no longer in use"

Ok, it delayed the uploading. Again, not a failure.


Collapse -
Thanks for the clarity...
by glenn30 / January 25, 2006 6:04 AM PST
In reply to: Read the warning.

The post to which I replied and that you deleted didn't make much sense. Maybe you were trying to correct and error... I do no know. I'm through with this!


Collapse -
by pmchefalo / January 27, 2006 6:31 PM PST
In reply to: Read the warning.

Mr. Proffit, your advice here is very poor. I have posted the fix elsewhere, and the potential problem. If you actually had some experience with this problem, you would have a different opinion. But your response suggests that you like being a Guru w/o the years of suffering on the mountain-top.

A perfect Registry event viewer is actually something to strive for. Seriously. If you want a stable system. Just because you don't have the answer off-the-top of your head doesn't mean it isn't an issue.

Collapse -
Not so and although...
by Edward ODaniel / January 27, 2006 10:58 PM PST

you "posted the fix elsewhere" you did so THREE DAYS AFTER Griff did in this thread ( and many long months after I and others did in other threads (such as this one in early December.

This is a "nice to have" utility but not a "must have" utility and essentially the worst you experience is slow shut down if using roaming profiles if you ignor the issue.

As Bob noted it isn't really a problem.

More info for you:
(in the last link do note the resolution:
You do not have to do anything. You can ignore the warning.)

Collapse -
I read the warning! Nothing like your post shows :(
by glenn30 / January 25, 2006 5:53 AM PST
In reply to: Event Viewer Warning ?

You are not much help! Thanks anyway. Anyone else want to take a stab?


Collapse -
(NT) (NT) Deletion of double post put this under wrong reply :(:(
by glenn30 / January 25, 2006 5:57 AM PST
Collapse -
How to fix a non-failure?
by R. Proffitt Forum moderator / January 25, 2006 6:05 AM PST

Maybe I could dive deeper into this, but where is the failure?

Find something that's not working proper. I've worked this issue years ago when XP first rolled and learned quickly to help people discern when we dive in and when we set the item aside till we get a failure to fix. It is not a warning of impending doom. It's a notification that it delayed the upload.

Some are perfectionists and can't deal with this OS's oddities. I think I have about 20 or more cases where "warnings" do occur and are proper.

Your choice to spend a lot of time here, but my question is...

What's failing?


Collapse -
(NT) (NT) Never mind... sorry I took your time!
by glenn30 / January 25, 2006 6:09 AM PST
Collapse -
Looked one more time. "Nothing you can do"
by R. Proffitt Forum moderator / January 25, 2006 6:15 AM PST
In reply to: Event Viewer Warning ?
Collapse -
(NT) (NT) That's an explanation even I can understand! Thanks.
by glenn30 / January 25, 2006 6:26 AM PST
Collapse -
by Themisive / January 25, 2006 7:00 AM PST

Try this maxim, "If it ain't broke, don't fix it", I'm sure Bob and quite a few others work that way, basically you're panicking over nothing.

Collapse -
(NT) (NT) Well... really makes me rest easy now that I know.
by glenn30 / January 25, 2006 8:45 AM PST
In reply to: Also
Collapse -
Glenn, If You Want To Make The Error Go Away
by Grif Thomas Forum moderator / January 25, 2006 9:05 AM PST

Microsoft does have a tool for that specific issue. It's a free download from the link below and runs as a service.. Still, as mentioned earlier, it doesn't really make much difference unless you happen to have an extremely long shut down time caused by the Userenv and the Event ID is 1000, 1517, or 1524. I've installed the service below and it has helped some computers with extremely long shut down times..If you're isn't experiencing that problem, there's really no need to install it because it causes another service to run in the background.. The service can be installed, then uninstalled if it doesn't help.:

User Profile Hive Cleanup Service

Hope this helps.


Collapse -
Grif, thank you very much.
by glenn30 / January 25, 2006 9:52 AM PST

This is no big deal for me but I really started this thread trying to find what it was. Only recently did the warning start appearing every day and then I noticed it was at shutdown time each day. That made me curious.

You detailed it quite nicely... not sure that I will download the tool but have noted longer shutdown times recently. If longer times continue I may try it.

Thanks again... I appreciate your interest and the courtesy of your in-depth reply.

Best regards,


Collapse -
There's a clue I can use.
by R. Proffitt Forum moderator / January 25, 2006 11:29 AM PST

When I asked for what's broken, that is a clue.

There is this issue with XP DMA which can cause a little longer boot, small delays and longer shutdown times. The procedure is simple. Set the IDE channels to PIO, click OK and then go back in and set them back to DMA, click OK. No reboot is required. notes it helped them.

It's worth a shot since it's no download and very easy.


Collapse -
SHOULD FIX -- Simple Utility from Microsoft
by pmchefalo / January 27, 2006 6:26 PM PST
In reply to: Event Viewer Warning ?

The USERENV warning is an error showing that some application is shutting down poorly. On a corporate betwork with roaming profiles this is big problem. For home users there is AT LEAST the inconvenience of waiting the sixty second while the registry times out. I think however that this error has potential to corrupt the Registry -- NOT A GOOD thing.

Microsoft has posted a simple and very effective tool that will eliminate this concern. Go to the Microsoft download site and search for the User Profile Hive Cleanup Tool. The description suggest that is only for Windows 2000 (this type of problem was severe in Windows 2000) but it also works VERY WELL on Windows XP. It is a small download, a simple install (click on the downloaded UPHClean-Setup.msi file) and does not require a reboot the first time you install it.

It will install a small program that will run at startup, and will cleanup the error message at shutdown, writing its own information that shows what the open Registry key/s was/were. For a sophisticated user(?!) this will indicate what the offending program is. Perhaps then you can look for an alternative program, a patch or a reinstallation, since this is not good behavior.

Since uphclean.exe becomes a running service, a subsequent update installation (went from 1.5 to 1.6 about two months ago) will ask you to reboot since it will be running in the background. I have absolutely no interference, system load, etc. from the tool, since it only springs into action when a userenv error is invoked, generally only when you shut down.

Since Microsoft has gone to the trouble of releasing this tool, and updating it at least once in the last six months, I think the problem is more severe than just "ignorable." I'd waste no time getting the tool and installing it. I use the tool on all my clients machines and they are easier to shut down and startup than before.

Laslty, beware of anyone who tells you that a Registry warning should be ignored. Sometimes there is a fix out there waiting, and a lurking problem that the unsophisticated don't appreciate.

Collapse -
Found this on Google...
by jnsturges / January 27, 2006 10:20 PM PST
In reply to: Event Viewer Warning ?

Thanks for the screen shot!!! I wish everyone would use them. I googled for:

Event Viewer 1517

and found this very helpful link:

Unfortunately, there is no way I can test it. Let me know how you made out.


Collapse -
I downloaded the Microsoft Tool....
by glenn30 / January 28, 2006 2:39 AM PST

that is mentioned (and linked) in the article you cite but as yet have not installed it. Only adverse effect I am seeing is a longer shutdown of Windows. I may not install unless things get worse... reason being is it creates still another startup item.

I believe this tool can be un-installed if later one has a change of mind.


Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?