Warning in Event Viewer "2 user registry handles leaked from \Registry\User\S-1-5-21-372863494-2545602876-1647677964-1003"

Hi,

Method 1:

Step 1:

Check for the issue in ‘Safe Mode with Networking’.

‘Safe Mode with Networking’ starts Windows in safe mode and includes the network drivers and services needed to access the Internet or other computers on your network.

Access the below link to know more about ‘Safe Mode with Networking’:
http://windows.microsoft.com/en-US/windows-vista/Advanced-startup-options-including-safe-mode

Step 2:

If the issue doesn’t persist in safe mode, I would suggest you to perform clean boot and check.

Place the computer in a clean boot state and then check if it helps. You can start Windows by using a minimal set of drivers and startup programs. This kind of startup is known as a "clean boot." A clean boot helps eliminate software conflicts.

How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

http://support.microsoft.com/kb/929135

Note: After troubleshooting, make sure the computer to start as usual as mentioned in Step 7 in the above KB article.

Method 2:

I would suggest you to download and install Microsoft safety scanner and run the scan and check.

http://www.microsoft.com/security/scanner/en-us/default.aspx

Note: The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again.

Note: Any data files that are infected may only be cleaned by deleting the file entirely, which means there is a potential for data loss.

Original Title: Registry

I get the below warning in the Event Viewer, any one can tell me what that means ?
2 user registry handles leaked from \Registry\User\S-1-5-21-372863494-2545602876-1647677964-1003: Process 780 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-372863494-2545602876-1647677964-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Process 928 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-372863494-2545602876-1647677964-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Hi, Sanjay_64,

Event ID 1530

1) This behavior occurs because Windows automatically closes any registry handle to a user profile that is left open by an application. Windows Vista does this when Windows Vista tries to close a user profile.

Note Event ID 1530 is logged as a Warning event. The application that is listed in the event detail is leaving the registry handle open and should be investigated.

http://support.microsoft.com/kb/947238

2) From a newsgroup post: "This warning event indicates that the Windows Vista system closed the handle that is left by an application for a user's profile in order to make this profile unload. To close this handle many critical system components on the hard drive such as svchost.exe will be called and then the warning "1530" will be added by event identification system because of this. Therefore, this warning notice is created by the profile unloading system and is a normal behavior. Please be assured that it will not cause any system performance problem. Instead, it is designed for the stability consideration when a user profile attempts to log off".       

http://www.eventid.net/display.asp?eventid=1530&eventno=8864&source=Microsoft-Windows-User%20Profiles%20Service&phase=1

That was a horrible response. At no point and time did you answer the question, 'any one can tell me what that means'. It looks as though you simply cut and pasted a generic answer.

Smittychat got it right when it was pointed out a program was probably terminated early. Oh ya, thanks for the help.