Shutdown and LSASS problem

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Recently, the past few days, I've suddenly gotten warning ID 1517 in
the Event Viewer:

-Windows saved user XXX registry while an application or service was
-still using the registry during log off. The memory used by the
-user's registry has not been freed. The registry will be unloaded
-when it is no longer in use.

I installed UPHclean to discover where the problem was, and it said:

-The following handles in user profile hive UPSTAIRS\Yahweh
-(S-1-5-21-3380930672-3385292856-934256048-1006) have been closed
-because they were preventing the profile from unloading successfully:

-LSASS.EXE (468)
-HKCU (0x3b8)
0x77e2a1aa ADVAPI32!CredFree+0x6c1
0x773418c0 comctl32!InitCommonControlsEx+0x1f7
0x773424bb comctl32!RemoveWindowSubclass+0x4e5
0x77341a0c comctl32!InitCommonControlsEx+0x343
0x77f56771 ntdll!RtlCreateHeap+0xf20
0x77f6151e ntdll!LdrGetProcedureAddress+0x5b6
0x77f570e0 ntdll!LdrLoadDll+0x1c5
0x77e7d901 kernel32!LoadLibraryExW+0xc8
0x77e73b45 kernel32!LoadLibraryW+0xd
0x7cd532fb shell32!Ordinal646+0x8ff
0x7cd29cea shell32!Ordinal517+0x29cea
0x77f5b42c ntdll!LdrInitializeThunk+0x24
0x77f56771 ntdll!RtlCreateHeap+0xf20
0x77f6151e ntdll!LdrGetProcedureAddress+0x5b6
0x77f570e0 ntdll!LdrLoadDll+0x1c5
0x77e7d901 kernel32!LoadLibraryExW+0xc8
0x77e73b45 kernel32!LoadLibraryW+0xd
0x7453fb4f LSASRV!LsaIFree_LSAPR_TRUST_INFORMATION+0x182b
0x7453fac5 LSASRV!LsaIFree_LSAPR_TRUST_INFORMATION+0x17a1
0x7453fa52 LSASRV!LsaIFree_LSAPR_TRUST_INFORMATION+0x172e
0x780038f7 RPCRT4!NdrServerInitializeNew+0x8f5
0x780791a5 RPCRT4!NdrStubCall2+0x1a5
0x780795aa RPCRT4!NdrServerCall2+0x17
0x78002d28 RPCRT4!NdrServerInitialize+0x269
0x78002ca5 RPCRT4!NdrServerInitialize+0x1e6
0x78002baf RPCRT4!NdrServerInitialize+0xf0
0x7800729b RPCRT4!I_RpcTransGetThreadEvent+0xe00
0x780071a7 RPCRT4!I_RpcTransGetThreadEvent+0xd0c
0x780070eb RPCRT4!I_RpcTransGetThreadEvent+0xc50
0x78006fc8 RPCRT4!I_RpcTransGetThreadEvent+0xb2d
0x78004d88 RPCRT4!NDRSContextMarshall2+0x222
0x78004cc2 RPCRT4!NDRSContextMarshall2+0x15c
0x78001a74 RPCRT4!<no symbol>
0xffffffff <no module>!<no symbol>

Any ideas? I haven't installed anything or changed anything lately.

Thanks --

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Ok. Thanks.

Shutdown is not substanially longer. One second or so. I read that
page from MS before posting here, which is how I knew of UPHClean.

It doesn't answer the question of why it suddenly started with LSASS
and how to stop, nor whether there are other hidden effects that may
be more problematic. It may be true that this particular effect needs
no "resolution", but there may be another effect that does require
attention that has a common cause with the 1517 warning.

Basically, I'm simply curious as to the WHY of things, not just the
hiding of them.

Thanks for your help.

Ron Z.


On Sat, 3 Sep 2005 10:14:06 -0600, "Wesley Vogel"
<123WVogel955@comcast.net> wrote:

>The way I see it, you have two choices, run UPHclean and have two
>Information events or uninstall it and have Userenv/1517, Userenv/1524 or
>Userenv/1500 Errors and Warnings and shutdown taking longer while trying to
>unload the registry.
>
>This MSKB article has not been updated since June 6, 2004.
>Troubleshooting profile unload issues
>http://support.microsoft.com/default.aspx?scid=kb;en-us;837115

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

After installing and running UPHclean my machine shuts down about two
minutes quicker.

This is the 1201 that I get...
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
The following handles in user profile hive MYPENTIUM450\Wesley P. Vogel
(S-1-5-21-1708537768-1580436667-1202660629-1003) have been closed because
they were preventing the profile from unloading successfully:

lsass.exe (436)
HKCU (0x3f8)

I believe that the (436) after lsass.exe is the PID (Process identifier).
This number will change every boot. Right now lsass.exe is 440.

Apparently lsass.exe is what loads and unloads the registry hives. I do not
know for sure.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:ftkjh19petv1prqfpmrngjd6otv4cfe2fq@4ax.com,
Zonk <mistybarnyard@hotmail.com> hunted and pecked:
> Ok. Thanks.
>
> Shutdown is not substanially longer. One second or so. I read that
> page from MS before posting here, which is how I knew of UPHClean.
>
> It doesn't answer the question of why it suddenly started with LSASS
> and how to stop, nor whether there are other hidden effects that may
> be more problematic. It may be true that this particular effect needs
> no "resolution", but there may be another effect that does require
> attention that has a common cause with the 1517 warning.
>
> Basically, I'm simply curious as to the WHY of things, not just the
> hiding of them.
>
> Thanks for your help.
>
> Ron Z.
>
>
> On Sat, 3 Sep 2005 10:14:06 -0600, "Wesley Vogel"
> <123WVogel955@comcast.net> wrote:
>
>> The way I see it, you have two choices, run UPHclean and have two
>> Information events or uninstall it and have Userenv/1517, Userenv/1524 or
>> Userenv/1500 Errors and Warnings and shutdown taking longer while trying
>> to unload the registry.
>>
>> This MSKB article has not been updated since June 6, 2004.
>> Troubleshooting profile unload issues
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;837115

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Oh my. Two MINUTES faster? Mine take all of 4 seconds WITHOUT
UPHClean.

Anyhow, thanks for your replies. Maybe it will go away as mysteriously
as it began--my curiosity just gets the better of me. I have the event
viewer log going back nearly 2 years, and never had one of these
warnings until 2 days ago.


On Sat, 3 Sep 2005 15:58:43 -0600, "Wesley Vogel"
<123WVogel955@comcast.net> wrote:

>After installing and running UPHclean my machine shuts down about two
>minutes quicker.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

How long has UPHClean been installed?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:987kh1l7bs9llkm22kv0vn1oopu2rosjv3@4ax.com,
Zonk <mistybarnyard@hotmail.com> hunted and pecked:
> Oh my. Two MINUTES faster? Mine take all of 4 seconds WITHOUT
> UPHClean.
>
> Anyhow, thanks for your replies. Maybe it will go away as mysteriously
> as it began--my curiosity just gets the better of me. I have the event
> viewer log going back nearly 2 years, and never had one of these
> warnings until 2 days ago.
>
>
> On Sat, 3 Sep 2005 15:58:43 -0600, "Wesley Vogel"
> <123WVogel955@comcast.net> wrote:
>
>> After installing and running UPHclean my machine shuts down about two
>> minutes quicker.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Since a few hours after getting that first warning 2 days or so ago.

On Sat, 3 Sep 2005 18:55:43 -0600, "Wesley Vogel"
<123WVogel955@comcast.net> wrote:

>How long has UPHClean been installed?

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

I clear the event logs daily, however, I keep records of every Information,
Warning and Error.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Date: 12/25/2003
-----
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 11/18/2003
-----
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 11/19/2004
-----

Notice the dates on the errors above.

Have fun troubleshooting. ;-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:dlhkh15g73t39all90kqk085b1oto5oekp@4ax.com,
Zonk <mistybarnyard@hotmail.com> hunted and pecked:
> Since a few hours after getting that first warning 2 days or so ago.
>
> On Sat, 3 Sep 2005 18:55:43 -0600, "Wesley Vogel"
> <123WVogel955@comcast.net> wrote:
>
>> How long has UPHClean been installed?

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Those dates aren't significant to me. I'm not sure how to proceed
troubleshooting. I retreated to a Ghost backup of a few weeks ago,
and the warning was gone. I went to Windows Update, got some of the
recent 'critical' patches the backup lacked, and within a couple of
boots, the warning had returned.
So, it could be an update causing the issue, but, since it wasn't
occuring _immediately_ after the update, maybe not. In other words,
I've got very little.

On Sun, 4 Sep 2005 09:38:55 -0600, "Wesley Vogel"
<123WVogel955@comcast.net> wrote:

>I clear the event logs daily, however, I keep records of every Information,
>Warning and Error.
>
>Event Type: Error
>Event Source: Userenv
>Event Category: None
>Event ID: 1500
>Date: 12/25/2003
>-----
>Event Type: Warning
>Event Source: Userenv
>Event Category: None
>Event ID: 1517
>Date: 11/18/2003
>-----
>Event Type: Warning
>Event Source: Userenv
>Event Category: None
>Event ID: 1524
>Date: 11/19/2004
>-----
>
>Notice the dates on the errors above.
>
>Have fun troubleshooting. ;-)