One of the most common complaints among Windows 2000 and XP users is that it takes too long for a user to log off. Sometimes this is a symptom of other problems; the user profile does not unload or a user's roaming profile does not reconcile. The most extreme version of this problem is when the user attempts to log off and an error is logged indicating that the registry has reached its maximum size.
The most common event log that indicates a problem is an event ID 1000 or 1500 with the description "Windows cannot unload your registry file." This error is not fatal, but it is problematic, and it should be corrected before it becomes chronic.
The most common reason for this happening is system services or programs that run in the background which don't terminate correctly or relinquish their handles on the registry. On a system with many services running -- some of which are highly interdependent -- debugging a problem like this can be difficult.
Microsoft has created a tool, UPHCLEAN (User Profile Hive Cleanup Service), that allows the system to monitor applications that access the user registry hives, and determine if an application has left keys open at logoff. If this happens, UPHCLEAN will log the application name and the keys in question, release the keys in question and complete the logoff process. This will not only allow users to log off cleanly, but also allow the problem application to be flagged.
UPHCLEAN has an option to only report the problem applications without forcing open handles to close. To do this, edit the registry and add two keys at HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUPHCleanParameters. The keys, both DWORD, should be named REPORT_ONLY and CALLSTACK_LOG, and set to a hex or decimal value of 1.
UPHCLEAN can be downloaded from Microsoft at this address.
Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!