EventID: 1530 User registry handles leaked

Question

After user logoff, the error observed in the event viewer.

Log Name: Application

Source: Microsoft-Windows-User Profiles Service

Date: 07-11-2020 21:57:29

Event ID: 1530

Task Category: None

Level: Information

Keywords:

User: SYSTEM

Computer: Server.Domain.com

Description:

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.

DETAIL -

10 user registry handles leaked from \Registry\User\S-1-5-21-3948394408-3063370748-2683190124-1436:

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore\Parents

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore

Process 1524 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Main

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Policies\Microsoft\Internet Explorer\Main

Process 1860 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\System\GameConfigStore\Children

Process 5188 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3948394408-3063370748-2683190124-1436\SOFTWARE\Microsoft\Internet Explorer\Security

Answer 1

Hi,

Thank you for coming Microsoft Q&A.

We noticed you encounter an expected waring event log which caused as Windows automatically closes any registry handle to a user profile that is left open by an application.

According to Microsoft states, starting with Windows Vista, the User Profile Service will force the unloading of a user profile when that user logs off. This is a situation where the functionality of forcing the unload of the user profile may break an application if registry handles are not closed in the process. This new User Profile Service functionality is the default behavior. (Source: A COM+ application may stop working in Windows when a user logs off)

We could try the resolution recorded in that source article to enable group policy Do not forcefully unload the user registry at user logoff policy which is located under Computer Configuration > Administrative Templates > System > User Profiles.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Something here might help.
https://support.microsoft.com/en-us/help/947238/event-id-1530-may-be-logged-in-the-application-log-in-windows

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

How to investigate this issue?

I'd start with the process IDs. Task Manager\Processes. Also try from a clean boot.
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

This is WS2016 uses as a master image in Citrix Provisioning Service

This forum focuses on the operating system itself. You could ask for help with Citrix Provisioning Service here in dedicated forums
https://discussions.citrix.com/forum/1358-provisioning-server-for-desktops/

--please don't forget to Accept as answer if the reply is helpful--

Answer 5

This Event is based on Microsoft-Windows-User Profiles Service