Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after <number> attempts.
From Microsoft MSDN library:
"A program or service was editing the registry when Windows 2000 tried to unload and update the registry portion of the user profile. As a result, Windows 2000 had to try repeatedly, and finally succeeded. If it had not succeeded, the user profile might not be current, and the local and roaming profiles might not match.

User Action:
Look for messages indicating that the system (or another program) failed to close, unload, or update the registry. If a pattern emerges, you might have a faulty program or service.

This condition often arises on computers running programs that update the registry at logoff, such as Terminal Services. Use the "Maximum retries to unload and update user profile" Group Policy setting to increase the number of times the system tries to unload the registry settings.

Keep a record of the programs running when this message appears. If you can identify a faulty program, contact the manufacturer for a repair or replacement program."
Install the Microsoft User Profile Hive Cleanup Service to resolve this problem.
Deleting the user's profile using an administrative account does not work because files UsrClass.dat and UsrClass.dat.LOG in folder Documents and settings\<UserName>\Local settings\Application data\Microsoft\Windows are locked and can't be removed. However these two files can be deleted in console mode. The User "Username" can now login and have no problem at logout. Before doing that you may create a "temporary user" and copy "Username" settings to save and restore them once "Username" has logged in/out again.
In our case, on a Win2K server, I have a cmd script that runs on a schedule, and spawns a second script before exiting. Windows processed a logout after the original scipt terminated, but had to wait until the spawned script terminated before it could commit the registry. For the short term, I put in a delay at the end on the original script; longer term, I will modify the way it works so the original can wait for the called script to exit first.
The fix ME814770 works fine and corrects the problem of the slow shutdown (including the roaming profile problem) because of the open handles which occur when the PC is started. It was mainly the problem of the print spooler and not the problem of a printer driver. We had seen that the problem of occasional shutdow problems remained but after several test we found out that McAfee VirusScan Enterprise 7.0 was the program that caused the problem. After downgrading to version 4.5.1 the problems went away. I've seen that also Symantec Antivirus can produce the same errors.

From a newsgroup post: "I just found this at Norton's website:
Description: Windows could not save the registry settings in your user profile on its first try because another program or service was editing them. Windows tried again and saved them after 9 attempts. NOTE: The number of attempts may vary.
This issue is being investigated. Please check back with us periodically for an update.

Workaround: Keeping the server console logged-in or locked at all times prevents this error from happening. NOTE: This issue does not occur if an account is logged into the server console."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.