Re: Q329170 (MS02-070), Q327984 and slow logoffs
From: Waller, William (Butch) (William.Waller@HP.COM)
Date: 03/24/03
- Previous message: Ziggy Bialzik: "Re: Q329170 (MS02-070), Q327984 and slow logoffs"
- Maybe in reply to: Christopher Hill: "Q329170 (MS02-070), Q327984 and slow logoffs"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 24 Mar 2003 08:01:01 -0600 From: "Waller, William (Butch)" <William.Waller@HP.COM> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
HP has been working with Microsoft PSS for over 4 months on this issue.
Here are the latest notes on the issue from Microsoft:
------------------------------------------------------------------------
-------------------------------------------------------------------
The following is the chain of events that causes the error message.
- The registry provider (STDPROV) is loaded to retrieve the
registry data needed to populate InternetExplorerInfo. When STDPROV is
initialized it loads the registry hive for the current user, which in
this case is SYSTEM.
- The Windows Installer provider (MSIPROV) loads to retrieve
data needed to populate instances of Win32_Product. MSIPROV requires
data from the current user's registry hive (SYSTEM) but it does not need
to load the hive because it was already loaded by STDPROV.
- Before MSIPROV has completed enumerating Win32_Product,
STDPROV attempts to unload the registry hive because it thinks it is no
longer needed. The registry hive fails to unload because MSIPROV is
still using it. Hence the Error 1000 message.
- Because the registry hive was already loaded when MSIPROV was
initialized, MSIPROV assumes that whoever loaded it will take care of
unloading it. Hence, the SYSTEM hive remains loaded.
The error message in this case is actually benign because leaving the
SYSTEM hive loaded should not cause any problems. However, we should be
able to modify the Windows Installer provider (MSIPROV.DLL) to eliminate
the error message and ensure that the SYSTEM hive is unloaded. I've
examined the source code and I am currently investigating a couple of
possible solutions.
------------------------------------------------------------------------
-------------------------------------------------------------------
The event id:1000 is a generic message that covers a lot of ground, so
this may not exactly fit what you're seeing, Chris, but Microsoft is
aware of at least this much.
Regards,
Butch Waller
HP Managed Services
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
TICSA - Anniversary Special - Limited Time
Become TICSA certified for just $221.25 US when you register before 3/31/03
with PROMO "TS0103" at www.2test.com. NO membership fees, certification
good for 2 years. Price for international delivery just $296.25 US, with
this offer. Offer cannot be combined with any other special and expires
3/31/03. Visit www.trusecure.com/ticsa for full details.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
- Previous message: Ziggy Bialzik: "Re: Q329170 (MS02-070), Q327984 and slow logoffs"
- Maybe in reply to: Christopher Hill: "Q329170 (MS02-070), Q327984 and slow logoffs"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
