Wednesday, 8 April 2015

Event 1530 - Windows detected your registry file is still in use

Problem:

One of my installed Apllication's Windows Service not started automatically and I tried to start it manually, but it again failed to start, then I have started to analyze through event logs and find the below warning event 1530 with error message "Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards".
Log Name:      Application
Source:        Microsoft-Windows-User Profiles Service
Date:          4/8/2015 01:45:18 AM
Event ID:      1530
Level:         Warning
Computer:      myPC.myDomain.Com
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold 
your registry file may not function properly afterwards.  

 DETAIL - 
 1 user registry handles leaked from \Registry\User\S-1-5-21-745457877-148782331-813991262-2636_Classes:
Process 1984 (\Device\HarddiskVolume3\Program Files
\Program Files\MTS\MyService.exe) has opened key \REGISTRY\USER\S-1-5-21-745457877-148782331-813991262-2636_CLASSES

Cause:

After I have analyzed some time, found this warning event was logged due to service account (The service account used only to run widows service and it was not used to login into system). This warning event (1530) is logged by the behavior of system design.

Other related links

- http://support.microsoft.com/en-us/kb/947238
- http://answers.microsoft.com/en-us/windows/forum/windows_7-security/event-id1530-microsoft-windows-user-profiles/a1ca9fd0-5449-46b6-aae2-35e3edcf8425
- http://social.technet.microsoft.com/wiki/contents/articles/3134.user-profile-service-event-1530-the-windows-operating-system-detected-that-your-registry-file-is-still-in-use-by-other-applications-or-services.aspx

Advertisements
Advertisements

No comments:

Post a Comment