Sebin
2/9/2006 5:55:00 PM
Hi,
After installing UPH clean service in our production server, we observe that
a lot of entries are created in the application log as follows:
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1501
Date: 2/9/2006
Time: 8:34:02 AM
User: PRODNAM\comservice
Computer: BURWEB1
Description:
The following handles opened in user profile hive PRODNAM\comservice
(S-1-5-21-1744866317-3243425524-4050422594-1114) are preventing the profile
from unloading:
dllhost.exe (7848)
HKCU\Software\Classes (0x528)
0x77fb6221 ADVAPI32!ElfFlushEventLog+0x1d9a
0x77fb5b39 ADVAPI32!ElfFlushEventLog+0x16b2
0x77f6dc4b ADVAPI32!RegOpenKeyExW+0xd6
0x776a8350 ole32!RegisterDragDrop+0x11e1
0x776a7c2d ole32!RegisterDragDrop+0xabe
0x776a7917 ole32!RegisterDragDrop+0x7a8
0x776ac033 ole32!CoGetMalloc+0x615
0x776ac069 ole32!CoGetMalloc+0x64b
0x776ac0a1 ole32!CoGetMalloc+0x683
0x77690b7d ole32!CoRegisterChannelHook+0x1649
0x7770e3cb ole32!CoQueryAuthenticationServices+0x1ddb
0x7771064c ole32!CoQueryAuthenticationServices+0x405c
0x777108b8 ole32!CoQueryAuthenticationServices+0x42c8
0x777109d9 ole32!CoQueryAuthenticationServices+0x43e9
0x7771127c ole32!CoQueryAuthenticationServices+0x4c8c
0x7768c03f ole32!CoGetInterfaceAndReleaseStream+0x39b4
0x75c4ae46 COMSVCS!DllUnregisterServer+0x40ac8
0x776f1f71 ole32!OleConvertIStorageToOLESTREAM+0x372a
0x77688180 ole32!CoSetProxyBlanket+0xea2
0x77689e5b ole32!CoGetInterfaceAndReleaseStream+0x17d0
0x77689da5 ole32!CoGetInterfaceAndReleaseStream+0x171a
0x776a3878 ole32!StgOpenStorage+0x5476
0x75c4ae46 COMSVCS!DllUnregisterServer+0x40ac8
0x776f1f71 ole32!OleConvertIStorageToOLESTREAM+0x372a
0x77724755 ole32!CoInstall+0xa6f
0x7770f0eb ole32!CoQueryAuthenticationServices+0x2afb
0x7770fb38 ole32!CoQueryAuthenticationServices+0x3548
0x77710042 ole32!CoQueryAuthenticationServices+0x3a52
0x77694098 ole32!GetHGlobalFromStream+0x46a
0x777127fd ole32!CoCreateObjectInContext+0xfb4
0x77724bb1 ole32!CoInstall+0xecb
0x7772483f ole32!CoInstall+0xb59
0x776ab15f ole32!CoGetTreatAsClass+0x65e
0x776aa330 ole32!RegisterDragDrop+0x31c1
0x776aa2e1 ole32!RegisterDragDrop+0x3172
0x776ab249 ole32!CoGetTreatAsClass+0x748
0x776a9b68 ole32!RegisterDragDrop+0x29f9
0x75bc1a87 COMSVCS!DispManGetContext+0xfa1c
0x776a9b68 ole32!RegisterDragDrop+0x29f9
0x776a9903 ole32!RegisterDragDrop+0x2794
HKCU\Software\Classes (0x530)
0x77fb6221 ADVAPI32!ElfFlushEventLog+0x1d9a
0x77fb5b39 ADVAPI32!ElfFlushEventLog+0x16b2
0x77f6dc4b ADVAPI32!RegOpenKeyExW+0xd6
0x776a8350 ole32!RegisterDragDrop+0x11e1
0x776a7c2d ole32!RegisterDragDrop+0xabe
0x776a7917 ole32!RegisterDragDrop+0x7a8
0x776ac033 ole32!CoGetMalloc+0x615
0x776ac069 ole32!CoGetMalloc+0x64b
0x776ac0a1 ole32!CoGetMalloc+0x683
0x77690b7d ole32!CoRegisterChannelHook+0x1649
0x77690ca1 ole32!CoGetClassObject+0xa6
0x77690c1b ole32!CoGetClassObject+0x20
0x792d598a mscorSVR!ReleaseFusionInterfaces+0x21432
0x792d7b99 mscorSVR!ReleaseFusionInterfaces+0x23641
0x792bd94b mscorSVR!ReleaseFusionInterfaces+0x93f3
0x791ca8be mscorSVR!Ordinal76+0x1a8be
0x791b224f mscorSVR!Ordinal76+0x224f
0x791b2364 mscorSVR!Ordinal76+0x2364
0x00ca916c <no module>!<no symbol>
0x00ca8c5e <no module>!<no symbol>
0x00ca8736 <no module>!<no symbol>
0x00ca8269 <no module>!<no symbol>
0x00ca449f <no module>!<no symbol>
0x00ca36e7 <no module>!<no symbol>
0x791b3208 mscorSVR!Ordinal76+0x3208
0x791f4512 mscorSVR!GetAssemblyMDImport+0xbbf9
0x79326195 mscorSVR!ReleaseFusionInterfaces+0x71c3d
0x792c6235 mscorSVR!ReleaseFusionInterfaces+0x11cdd
0x79316fa3 mscorSVR!ReleaseFusionInterfaces+0x62a4b
0x7931700c mscorSVR!ReleaseFusionInterfaces+0x62ab4
0x77731c0c ole32!ComPs_NdrDllUnregisterProxy+0x2d4
0x7770f39d ole32!CoQueryAuthenticationServices+0x2dad
0x7770f6d5 ole32!CoQueryAuthenticationServices+0x30e5
0x77711174 ole32!CoQueryAuthenticationServices+0x4b84
0x77733684 ole32!ComPs_NdrDllUnregisterProxy+0x1d4c
0x77730326 ole32!CoDosDateTimeToFileTime+0x492d
0x776bfdc3 ole32!CoGetInterceptorFromTypeInfo+0xb77
0x777326ce ole32!ComPs_NdrDllUnregisterProxy+0xd96
0x75c3d0c4 COMSVCS!DllUnregisterServer+0x32d46
0x75c3d2e4 COMSVCS!DllUnregisterServer+0x32f66
HKCU\Software\Classes (0x6b4)
0x77fb6221 ADVAPI32!ElfFlushEventLog+0x1d9a
0x77fb5b39 ADVAPI32!ElfFlushEventLog+0x16b2
0x77f6dc4b ADVAPI32!RegOpenKeyExW+0xd6
0x776a8350 ole32!RegisterDragDrop+0x11e1
0x776a7c2d ole32!RegisterDragDrop+0xabe
0x776a7917 ole32!RegisterDragDrop+0x7a8
0x776ac033 ole32!CoGetMalloc+0x615
0x776ac069 ole32!CoGetMalloc+0x64b
0x776ac0a1 ole32!CoGetMalloc+0x683
0x776b132c ole32!CoCreateInstanceEx+0x10b
0x776b1275 ole32!CoCreateInstanceEx+0x54
0x776b1244 ole32!CoCreateInstanceEx+0x23
0x776b14eb ole32!CoCreateInstance+0x39
0x777d51bf CLBCatQ!GetGlobalBabyJITEnabled+0x1571
0x77777dea ole32!StgGetIFillLockBytesOnFile+0x594f
0x776a9437 ole32!RegisterDragDrop+0x22c8
0x776a98df ole32!RegisterDragDrop+0x2770
0x776a9b68 ole32!RegisterDragDrop+0x29f9
0x776a9a9a ole32!RegisterDragDrop+0x292b
0x776b1275 ole32!CoCreateInstanceEx+0x54
0x776bcc0c ole32!ComPs_NdrDllGetClassObject+0x119e
0x75bad426 COMSVCS!Ordinal6+0x8a36
0x75badd1c COMSVCS!Ordinal6+0x932c
0x75b73c2f COMSVCS!CosGetCallContext+0x229f
0x75c39ab9 COMSVCS!DllUnregisterServer+0x2f73b
0x75c387c3 COMSVCS!DllUnregisterServer+0x2e445
0x75bd2d88 COMSVCS!CoCreateActivity+0xa3a
0x75bd2d68 COMSVCS!CoCreateActivity+0xa1a
0x75c454e4 COMSVCS!DllUnregisterServer+0x3b166
0x75c456b9 COMSVCS!DllUnregisterServer+0x3b33b
0x77bcb530 msvcrt!endthreadex+0xa3
0x77e66063 kernel32!GetModuleFileNameA+0xeb
Also, the following warning message also is logged into the application log
at different point of times.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 2/9/2006
Time: 8:34:12 AM
User: NT AUTHORITY\SYSTEM
Computer: BURWEB1
Description:
Windows saved user PRODNAM\comservice registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.
This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.
-----------------------------------------------------------------------------------------------
To add to the above information, the comservice account is configured as a
member of "Domain Admins group" as well as â??Domain Service Accountsâ??. There
are no custom services running under comservice user, but there are
components registered under COM+ under the identity of comservice user.
Any help on resolving the above issues are highly appreciated.
Regards,
Sebin Roy