Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after <number> attempts.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What are the registry files?
How are the registry loaded and unloaded?
What is a user profile?
How do roaming profiles get propagated to servers?
What is the role of Userenv?
From Microsoft MSDN library:
"A program or service was editing the registry when Windows 2000 tried to unload and update the registry portion of the user profile. As a result, Windows 2000 had to try repeatedly, and finally succeeded. If it had not succeeded, the user profile might not be current, and the local and roaming profiles might not match.
Look for messages indicating that the system (or another program) failed to close, unload, or update the registry. If a pattern emerges, you might have a faulty program or service.
This condition often arises on computers running programs that update the registry at logoff, such as Terminal Services. Use the "Maximum retries to unload and update user profile" Group Policy setting to increase the number of times the system tries to unload the registry settings.
Keep a record of the programs running when this message appears. If you can identify a faulty program, contact the manufacturer for a repair or replacement program."
Install the Microsoft User Profile Hive Cleanup Service to resolve this problem.
Jean Luc Doat
Deleting the user's profile using an administrative account does not work because files UsrClass.dat and UsrClass.dat.LOG in folder Documents and settings\<UserName>\Local settings\Application data\Microsoft\Windows are locked and can't be removed. However these two files can be deleted in console mode. The User "Username" can now login and have no problem at logout. Before doing that you may create a "temporary user" and copy "Username" settings to save and restore them once "Username" has logged in/out again.
In our case, on a Win2K server, I have a cmd script that runs on a schedule, and spawns a second script before exiting. Windows processed a logout after the original scipt terminated, but had to wait until the spawned script terminated before it could commit the registry. For the short term, I put in a delay at the end on the original script; longer term, I will modify the way it works so the original can wait for the called script to exit first.
The fix ME814770 works fine and corrects the problem of the slow shutdown (including the roaming profile problem) because of the open handles which occur when the PC is started. It was mainly the problem of the print spooler and not the problem of a printer driver. We had seen that the problem of occasional shutdow problems remained but after several test we found out that McAfee VirusScan Enterprise 7.0 was the program that caused the problem. After downgrading to version 4.5.1 the problems went away. I've seen that also Symantec Antivirus can produce the same errors.
From a newsgroup post: "I just found this at Norton's website:
Description: Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after 9 attempts. NOTE: The number of attempts may vary.
This issue is being investigated. Please check back with us periodically for an update.
Workaround: Keeping the server console logged-in or locked at all times prevents this error from happening. NOTE: This issue does not occur if an account is logged into the server console."
|Private comment: Subscribers only. See example of private comment|
|Links: ME814770, User Profile Does Not Roam, Microsoft User Profile Hive Cleanup Service|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated