Users Profile Hives

I am having problems with user profile hives. I have tried installing UPHclean.exe which does report the problem however does not prevent it from happening. I have tried to identify the service the is preventing the profile from unloading and it is generally associated with svchost.exe. Does anyone know what causes this and how to prevent it?

 

This may be somewhat tedious, but you can look through the modules loaded by svchost.exe by using the Taskmanager on Steroids.

http://users.adelphia.net/~abraxas/dl/TOS.zip


If you see loaded modules that belong to one of your apps rather than XP, you can try updating the app. If you find that the modules belong to XP, you can check the versions and be sure that none have been updated by Windows Update by checking the files that have been updated on your machine with the Windows Update List:

http://freehost14.websamba.com/nirsoft/utils/wul.html

 

Thanks for your reply Abraxas,

I will try what you suggested, however, can you please explain the significance of having files updated by windows update. Why does it matter and how do I change how certain files are updated with windows update? Again thank you for any help, this has been plauging for quite some time.

Zoran

 

im a little confused by the whole question.. You have a profile unload problem, because keys are open? And those keys are open by svchost? Which svchost? Which service is doing it? How does a service have your user profile? Are you running something under your credentials? Have you used uphclean to collect stacks? Im just bewildered by the whole idea

 

My thinking was that there are often updated XP files that repair more than what they were intended to repair when updates are installed. If one of the updated modules corrected a problem with the registry failing to unload, and somehow that update did not install successfully (qfecheck will tell you), a re-application of the update may help your problem.

 

Thanks for your questions Joe

I do have a windows profile unload problem. Im not exactly sure why I have this problem or if it is realted to any registry keys. I have tried to narrow my search by identifying the svchost.exe (656) as a potential problem through using UPHclean. I was able to get UPHClean to report the problem to the event viewer by configuring it in the registry (HKLM\System\CurrentContorlSet\Services\UPHClean\Parameters\REPORT_ONLY change value to 1), I also attempted to retrieve the stack information by also configuring the registry (HKLM\System\CurrentContorlSet\Services\UPHClean\Parameters\CALLSTACK_LOG change value to 1) but I am not sure where the output of information should be because it does not show up in the event viewer, or if it is I'm not recognizing it.

Other information that may be related is the fact that I am in a novel environment running NDS using roaming profiles. If you need more information I would be glad to supply you with anything that may help you help me. I, like you, am bewildered by the situation.

 

Ok, help me catch up here..

You saw from profile unload errors in the event log? 1517, 1524, 1000,or 1500 events?

Did you enable userenv logging?
http://www.microsoft.com/windows200...2000/techinfo/reskit/en-us/regentry/96328.asp
(setting it for 10002)

You did a google, and found uphclean, which promised to fix the problems..
What did it say, what do the events look like?

Somehow this data led you to SVCHOST. Have you run tlist -s on it to see which services are running in the offending svchost? Have you checked them to ensure they are all set to run as LOCAL SYSTEM? If you do some disabling, can you narrow down which service is doing it?