Re: Userenv EventId:1000 Access is denied

From: Torgeir Bakken (MVP) (Torgeir.Bakken-spam_at_hydro.com)
Date: 04/30/03 

Date: Wed, 30 Apr 2003 02:07:01 +0200

Frank wrote:

> When I logoff a user from the domain, most of the time
> it takes about a minute to logoff. I always have a
> message "Windows cannot unload your registry file" Access
> is denied.

Hi

This problem is very often introduced when the Q329170 Security Patch is
installed.

Go to Control Panel>Add/Remove Programs > Change/Remove Programs and see if
Q329170 is listed as an update. If it is, remove it and see if it solves the
problem. If you get a warning that other installs may stop working if you
remove it, just ignore it.

Q329170 is not very important or relevant unless you are
on a network where you have configured your Windows 2000
or Windows XP Gold systems to use SMB Signing (default
they do not use it):

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS02-070.asp

<quote>
Impact of vulnerability: Modify group policy.

Maximum Severity Rating: Moderate

Recommendation: Administrators whose Windows 2000 or Windows XP Gold systems
are configured to use SMB Signing should install the patch immediately.
</quote>

http://www.microsoft.com/security/security_bulletins/ms02-070.asp

<quote>
Why We Are Issuing This Update
An identified security issue in Microsoft® Windows® 2000 and Windows XP could
enable an attacker to modify a network's security policies. Network
administrators can help protect their networks by installing this update from
Microsoft. This update only affects networks running Windows 2000 or Windows
XP.

Home users and those using workstations on corporate networks do not need this
update.
</quote>

If you still want to have Q329170 installed, here is the latest from Microsoft:

There is now a fix available for customers experiencing slow logoff issues
after applying the security patch in Q329170. This patch is recommended only
for customers who are experiencing this issue.

More about this here:

Unexpected Delay When You Log Off Your Domain
http://support.microsoft.com/default.aspx?scid=kb;EN-US;814770

As the article states, you need to call Microsoft Product Support Services to
obtain the fix (outside the US, customers should contact their local Microsoft
subsidiary.). The support call will be be free as long as you refer to the
Knowledge Base Article number (Q814770) 

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

Relevant Pages

  • Re: controversial paper
    ... >best to never engage in a personal attack, ... The current situation is that Microsoft software and OS is ... Just look at Windows 2003 and how it's locked ... When I do an audit of most networks, ...
    (sci.crypt)
  • Re: 802.1X Setup using Server 03 and Aironet 1200 Series WAP help
    ... Office/Home Office or Small Organization Networks" ... communication between the wireless client and IAS just was not ... most of the 170 pg Microsoft pdf located at the link below. ... Windows" documentation http://technet.microsoft.com/en-us/library/bb457068.aspx ...
    (microsoft.public.internet.radius)
  • Networking Issues between WinXP client and Win2000 Svr
    ... My company is a Microsoft OEM and since the introduction of Windows XP ... we have been converting our networks over from Win95/98/NT to Windows ... We have been forced to bring documentation to our network customers ...
    (microsoft.public.windowsxp.general)
  • Re: logoff taking too long
    ... This problem is very often introduced when the Q329170 Security Patch is ... If you get a warning that other installs may stop working if you ... on a network where you have configured your Windows 2000 ... If you still want to have Q329170 installed, here is the latest from Microsoft: ...
    (microsoft.public.security)
  • Re: logoff taking too long
    ... This problem is very often introduced when the Q329170 Security Patch is ... If you get a warning that other installs may stop working if you ... on a network where you have configured your Windows 2000 ... If you still want to have Q329170 installed, here is the latest from Microsoft: ...
    (microsoft.public.win2000.security)