Windows 2000 unable to unload registry hive

From: Tony Chow (tchow@BLUETENTACLE.COM)
Date: 02/07/02


Date:         Wed, 6 Feb 2002 21:15:44 -0800
From: Tony Chow <tchow@BLUETENTACLE.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

I'm not sure how many people experience this following issue, but I've
encountered it ever since I started to deal with Windows 2000 in a
production environment a year and half ago.

Far too frequently, when a user logs out of a Windows 2000 computer
his/her roaming profile will fail to be uploaded to the server. In the
Event Log, the following entry can be found:

Event ID: 1000
Source: Userenv
Description:
Windows cannot unload your registry file. If you have a roaming
profile, your settings are not replicated. Contact your administrator.
DETAIL - Access is denied. , Build number ((2195)).

The registry hive will stay loaded ***until the computer has been
rebooted***, no matter how many times the user logs on and off. To the
end user, everything seems normal, but throughout this time, the local
and server copies of his/her profile becomes more and more out of sync,
and the latest version of the profile is not backed up (given that most
shops only back up servers.) Furthermore, should the user hop between
different workstations, he/she will find that the changes made to the
contents of his/her profile on one computer are not reflected on others.

But that's not the end of the agony. When the afflicted computer is
finally rebooted, and the user logs back onto it, a nasty surprise
awaits. The OS will try to download the remote copy of the profile, but
upon discovering that the local copy of ntuser.dat is newer than the
remote copy, it will load the local copy. This is as reasonable a
decision as the OS can possibly make at this point. Howerver, in
contrast to preserving the local copy of the registry hive and rejecting
the remote copy, Windows 2000 will accept both the local and remote
copies of the rest of the profile and ***merge*** them. This latter
behavior can have some very unsightly consequences. If the user has
just reorganized his/her desktop or favorites folder before the reboot
took place, he/she will find deleted files/folders mysteriously
resurrected, and two copies each of those files/folders that he/she had
moved to a different locale--one in the new location, the other in the
old location.

I have found two references to this problem in MSKB, Q269858 and
Q253820, both claiming that it has been fixed in the latest service
packs. But I beg to differ. Even with the latest patches, this problem
still occurs with alarming frequency.

I consider this a relatively serious issue. Registry entries are
usually no big deal, but some users tend to keep important documents on
their desktops, and many are highly sensitive to irregularities in their
favorites folders, how that web browsing has become an integral part of
American work habits. Windows 2000's inability to unload the registry
hive doesn't only prevent the hive itself from being replicated, but the
the rest of the profile as well.

Not finding much help from Microsoft or other users, I have devised the
following workarounds:

1) Ensure that the most important registry settings in HKCU are
enforced through administrative templates.
2) Relocate the user's desktop folder out of the profile and into a
subfolder within his/her home folder, by modifying the registry value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Use
r Shell Folders\Desktop. You can also use GPOs for this (though it
forces you to use UNCs for the folder location.)
3) Relocate the user's favorites folder out of the profile and into a
subfolder within his/her home folder, by modifying the registry value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Use
r Shell Folders\Favorites.

Steps 2 and 3 can be automated using GPOs and login scripts.

At my organization these modifications have almost rendered the symptoms
of the problem entirely moot. The desktop and favorites--arguably the
two folders in the profile that an average user is most aware of--are
now guaranteed to be backed up and consistent from place to place
regardless of the conditions of the user profiles, and profile merging
no longer wrecks any havoc where the user might take notice.

No significant side effects are in evidence, though because the desktop
and favorites folders now reside on file servers, end-user stations are
more closely tied to the health and presence of the servers. Those who
need to take their computers offline should be able to use Offline Files
to keep the desktop and favorites available when roaming, though I
haven't tried this enough to comment more specifically.

Or perhaps someone out there has a perfectly sound answer for all of
this, which is why I post here in the first place.

Cheers,
Tony Chow

______________________________________
There is no problem so difficult that it cannot be solved by brute
strength and ignorance. --William's Law

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by VeriSign - The Internet Trust Company
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Do you have 128-bit SSL encryption server security?
Get VeriSign's FREE Guide, "Securing Your Web Site for Business," and learn
everything you need to know about using 128-bit SSL to encrypt your
e-commerce transactions, secure your intranets and authenticate your Web
site. 128-bit SSL is serious security for your online business. Get it now!
http://www.verisign.com/cgi-bin/go.cgi?a=n094765650008000
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo



Relevant Pages

  • Re: Windows XP Personal Profile
    ... new program yesterday the personal profile/user profile was not ... As in the Windows registry. ... in), their Internet Explorer favorites folder, ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: OAB Sync issue with Exchange 2007 and Outlook 2007
    ... It sounds as if there is a reference to the old OAB in the profile. ... Checking for OAB Registry Keys ... Starting Test 9 - OAB System Folder Check ...
    (microsoft.public.exchange.admin)
  • Re: Text of KB Article Included - From error to missing system file
    ... This article describes how to recover a Windows XP system that does not start because of corruption in the registry. ... If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives. ... In part one, you start the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. ...
    (microsoft.public.windowsxp.general)
  • Re: Windows Server 2003 Service Pack 1 will not install
    ... You can try to install the Windows 2003 ... Expand to Windows Logs -> Application and right-click to select Save ... of the public folder database files. ... domain to the new SBS 2003 installation, way is to create a local profile, ...
    (microsoft.public.windows.server.sbs)
  • Re: OAB Sync issue with Exchange 2007 and Outlook 2007
    ... Have you tried to recreate the Outlook profile? ... Checking for OAB Registry Keys ... Starting Test 9 - OAB System Folder Check ...
    (microsoft.public.exchange.admin)