Applies to: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Windows Server 2012
Product
Microsoft Windows Operating System
ID
1530
Source
Microsoft-Windows-User Profiles Service; User Profile Service
Version
6.1
Symbolic Name
EVENT_HIVE_LEAK
Message
The Windows operating system detected that your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
Included in the following details are five examples of the type of information that can appear in this event message:
1 user registry handles leaked from \Registry\User\S-1-5-21-3112862306- 1016156048-4130204762-1000: Process 932 (\Device\HarddiskVolume1\ Windows\System32\svchost.exe) has opened key \REGISTRY\USER\ S-1-5-21-3112862306-1016156048-4130204762-1000
1 user registry handles leaked from \Registry\User\S-1-5-21-4211544788- 2274021965-2216582883-1001_Classes: Process 3568 (\Device\HarddiskVolume3 \Windows\System32\WUDFHost.exe) has opened key \REGISTRY\USER\ S-1-5-21-4211544788-2274021965-2216582883-1001_CLASSES
5 user registry handles leaked from \Registry\User\S-1-5-21-4211544788- 2274021965-2216582883-1001: Process 1880 (\Device\HarddiskVolume3\ Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\ Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21- 4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\ Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine \18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788- 2274021965-2216582883-1001 Process 1880 (\Device\HarddiskVolume3\Program Files (x86)\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe) has opened key \REGISTRY\ USER\S-1-5-21-4211544788-2274021965-2216582883-1001
1 user registry handles leaked from \Registry\User\S-1-5-21-4211544788-2274021965- 2216582883-1001: Process 2492 (\Device\HarddiskVolume3\Windows\System32\ msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-4211544788-2274021965- 2216582883-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
This event can be caused by apps that do not release their Registry keys before shutting down. This most often occurs when an app runs in the background and does not release its Registry keys when a user signs off, in which case Windows forces the Registry to unload. There is no impact to users, though in rare cases recent configuration changes in the app might not be saved.
No user action is required - this is an acceptable condition.
Daniel Yurman edited Revision 22. Comment: This issue caused Windows 7 home premium to fail to load the user profile. It produced a .bak profile in the registry.
Jason Gerend_MSFT edited Revision 19. Comment: Thanks for your feedback – we understand that this event is causing confusion (and frustration!). For now, hopefully this article (and our rewritten Cause section) helps; we’re also investigating what we can do to improve this event in the future.
Jason Gerend_MSFT edited Revision 12. Comment: Added tags to support Event Viewer hookup for Windows 7
Jason Gerend_MSFT edited Revision 8. Comment: Updated to reduce confusion over resolutuion
Ed Price - MSFT edited Revision 2. Comment: Font style, tags
Fernando Lugão Veltem edited Revision 1. Comment: added TOC and tags
re: "Event ID 1530 is logged as a Warning event. The application that is listed in the event
detail is leaving the registry handle open, and it should be investigated."
What do you mean by "should be investigated."? Invetigate, how?
Thank you.
If this is a "NORMAL" condition then why the hell is it a warning in the logs, there's already enough crap in there without tracking down normal ***.
Like others here I'm chasing down non existent proplems; and that's us imagine how many don't get this far......
The 3 remarks above me are very sarcastic,I was gonna leave 1 myself but looks like you 3 covered all the bases!
Thanks...No user action required-this is a normal condition..this is all I needed to read to put my mind at ease...
A warning that is a normal action...did I read that correctly?
Thanks for your feedback – we understand that this event is causing confusion (and frustration!). For now, hopefully this article (and our rewritten Cause section) helps; we’re also investigating what we can do to improve this event in the future.
This error also caused the user profile to fail to load. The error message refers to registry handle leaks.
Yes, indeed, users are unable to log in when this event occurs, because the user profile fails to load.