I've been receiving User Profile Service event id 1530 with nearly every logout from an rdp session. Our environment is Windows 2008 R2 64 bit running on Citrix XenServer 5.5. RDP is in remote administration mode. Tested with and without Windows updates applied. No additional printers added, no connection to a domain.
Because the environment is virtual, I've been able to try many combinations and have narrowed it down to this: When Windows 2008 R2 has a single processor, the event does not occur. When I give the virtual server two processors, the event occurs with nearly every RDP logout. Same results with or without XenTools installed. I do not have the resources to test the single/multi processor difference on physical hardware.
Any insights would be appreciated. I've posted the full event as well as information about the process that is mentioned in the event.
AB.
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 7/23/2010 8:38:51 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: WIN-36DPBES2P14
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-2545583-721118796-2022419212-1000:
Process 888 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2545583-721118796-2022419212-1000\Printers\DevModePerUser
----------
Process 888 is svchost.exe running UxSMS (Desktop Window Manager Session Manager), UmRdpService (Remote Desktop Services UserMode Port Redirector, TrkWKS (Desktop Distributed Link Tracking Client), and Netman (Network Connection)