You experience log off problems on a Windows XP-based, Windows Server 2003-based, Windows 2000-based, or Windows NT 4.0-based computer

When you try to log off your computer, you cannot log off, or event messages that are logged in the Application log indicate that the user profile was not unloaded. This problem may occur if Microsoft Windows or third-party programs do not stop running when you try to log off your computer. This article contains a step-by-step method to help you resolve this problem.

If you are viewing this Web content on the computer that has the problem, you can use the automatic detection and fix tool that this content contains. The tool will help make the troubleshooting process faster, more accurate, and much easier for you. If you are not on the computer that has the problem, print this Web content, and use it on the computer that has the problem.

Note Many shutdown problems are not caused by user profile unloading errors. For more information about shutdown problems, click the following article numbers to view the articles in the Microsoft Knowledge Base: Note Windows Vista and Windows Server 2008 include the functionality of the automatic detection and fix tool (DPHClean) that this content contains. If you are experiencing prooblems logging off Windows Vista and Windows Server 2008, vist the following Microsoft Web sites.

• For more information about Windows Vista, visit the Windows Vista Solution Center:
  http://support.microsoft.com/ph/11732 (http://support.microsoft.com/ph/11732)
• For more information about Windows Server 2008, visit the Windows Server 2008 Solution Center:
  http://support.microsoft.com/ph/12925 (http://support.microsoft.com/ph/12925)

When you try to log off a computer that is running Windows Server 2003, Windows XP, Windows 2000, or Windows NT 4.0, you may experience one or more of the following symptoms:

• The application event IDs 1000, 1500, 1517, 1524 are logged in the Application log. Viewing events in the Application log is the most accurate method to determine user profile unload errors. If you do not see these events in the Application log, you do not have user profile unload errors. For more information about the event messages in the Application log, see the Event messages in the Application log section.
• The cached profile is not deleted when you use a roaming user profile that is configured to delete the locally cached copy of the profile when you log off. Symptoms of this error are recorded as event messages in the Application log.
• In Windows XP and in Windows Server 2003, you can log off, but you cannot recover the memory that the user profile uses until the user profile can be unloaded. You can log off because the roaming user profile is reconciled by using a copy of the contents of the registry. Symptoms of this error are recorded as event messages in the Application log.
• When you try to log off in Windows 2000, the "Saving settings…" message is displayed for a long time, and Windows stops trying to log off. If you are using a roaming user profile on a network, Windows indicates that the user profile on the computer does not reconcile with the roaming user profile on the network. You cannot log on because the user profile did not log off. Symptoms of this error are recorded as event messages in the Application log.
• In Windows NT 4.0, you cannot log off and the roaming user profile is not reconciled.
• You reach the registry size limit (RSL).
• Backups may not start. There are no errors in the Application log from the backup program. However, if you see event ID 1524, the backup has not run.

To resolve this problem, use the Microsoft User Profile Hive Cleanup Service (UPHClean). UPHClean monitors the computer while you log off, and then UPHClean unloads and reconciles user profiles so that you can log off. This method shows how to install and to run UPHClean.

Note UPHClean is supported under the following operating systems:

• Windows XP
• Windows Server 2003
• Windows 2000 (all versions)

Note The current version of UPHClean (v1.6d) does not function under x64-based versions of Windows XP or of Windows Server 2003. A future version of UPHClean may be supported under those operating systems.

Important This method requires you to browse away from the page that you are now viewing. By browsing away from this page, the content that you are now viewing will no longer be displayed. So, before you continue, you might find it helpful to create a shortcut to this Web page on your desktop so that you can easily return to this page by double-clicking the shortcut. To create a shortcut to this Web page on your desktop, follow these steps:

1. Right-click this page, and then click Create Shortcut.
2. In the Internet Explorer dialog box, click Yes to create a shortcut on your desktop.

This method is rated: Easy.

Estimated Time: 10 minutes or more, depending on your Internet connection speed.

To use the Microsoft User Profile Hive Cleanup Service (UPHClean), follow these steps:

1. Download UPHClean. To download and install UPHClean, visit the following Microsoft Web site:
   http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582 (http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582)
   You will be prompted to validate your copy of Windows.
2. As soon as you have downloaded the UPHClean installer (UPHClean-Setup.msi), double-click the installer to begin the installation.
3. In the User Profile Hive Cleanup Service installation wizard, click Next.
4. In the License Agreement page, read the license agreement, select I Agree, and then click Next.
5. In the Select Installation Folder page, click Next.
6. In the Confirm Installation page, click Next.
7. When UPHClean is installed, click Close.
   
   Note UPHClean runs as a service in Windows and will start automatically every time that Windows starts.
8. To confirm that UPHClean is installed and running, click Start, and then click Run.
9. In Open box, type the following text, and then click OK:
   
   services.msc
10. In Services, in the Name column, locate User Profile Hive Cleanup. In the Status column, confirm that the User Profile Hive Cleanup service is Started.

Important Windows Vista and Windows Server 2008 include the functionality of UPHClean. Uninstall UPHClean before you upgrade to Windows Vista or to Windows Server 2008. For more information about how to uninstall UPHClean, see the How to uninstall the User Profile Hive Cleanup service section.

Note If you receive an error when you install UPHClean, try the following:

• Download UPHClean to your computer again. If you are trying to install UPHClean from a computer on your company's network, copy the UPHClean installer (UPHClean-Setup.msi) to your computer first. Then follow the steps in this section again to install UPHClean.
• Install the latest run-time components for Visual C++ applications. Then follow the steps in this section again to install UPHClean. If you are using Windows NT 4.0, restart your computer after you install the latest run-time components for Visual C++ applications.
  
  For more information about how to install the latest run-time components for Visual C++ applications, click the following article number to view the article in the Microsoft Knowledge Base:
  259403  (http://support.microsoft.com/kb/259403/ ) How to obtain the Visual C++ 6.0 run-time components

Verification

To verify that this method worked, log off Windows. Windows should log off immediatley. Open the Application log and detemine if any event messages indicate that there were user profile errors. For more information about the event messages in the Application log, see the Event messages in the Application log section.

If this method worked: If you can log off Windows, and there are no event messages that indicate that there were user profile unloading errors, you have successfully corrected the problem.

If this method did not work: If you cannot log off Windows, or there are event messages that indicate that there were user profile unloading errors, this method did not work. You might want to ask someone for help, or you might want to try Advanced Troubleshooting.

If the resources listed in this article do not help you resolve the problem or if you experience symptoms that differ from those that are described in this article, search the Microsoft Knowledge Base for more information. To search the Microsoft Knowledge Base, visit the following Microsoft Web site:
Then, type the text of the error message that you receive, or type a description of the problem, in the search field.

If the problem is not resolved, unfortunately this content is unable to help you any further. So, you might want to ask someone for help, or you might want to visit the following Microsoft Web site:

User profiles and user accounts

Your user profile is a collection of settings that make the computer look and work the way that you want it to look and to work. Your user profile contains your settings for desktop backgrounds, for screen savers, for pointer preferences, for sound settings, and for other features. User profiles make sure that your personal preferences are used when you log on to Windows.

A user profile differs from a user account that you use to log on to Windows. Each user account has at least one user profile associated with it.

A user account defines the actions a user can perform in Windows. On a stand-alone computer or on a computer that is a member of a workgroup, a user account establishes the permissions that are assigned to each user. On a computer that is part of a network domain, a user must be a member of at least one group. The permissions and the rights that are granted to a group are assigned to its members.

For information about user profile hives, visit the following Microsoft Web sites:

User Profile Hive Cleanup service

The User Profile Hive Cleanup service helps make sure that user sessions are completely ended when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases, the user session is prevented from completely ending. This can result in problems when you use roaming user profiles in a network environment or when locked profiles are used as implemented through the Shared Computer Toolkit for Windows XP.

In Windows 2000, you can benefit from the User Profile Hive Cleanup service if the Application log shows event ID 1000, and the message text indicates that the profile is not unloading and that the error is "Access is denied." On Windows XP and on Windows Server 2003, event IDs 1517 and 1524 indicate the same problem.

The User Profile Hive Cleanup service monitors for users who have logged off and for whom registry hives are still loaded. When this occurs, the service determines which applications have handles that are opened to the hives and releases them. It logs the application name and what registry keys were left open. After this occurs, the system finishes unloading the profile.

For more information about UPHClean, visit the following Microsoft Web sites:

Event messages in the Application log

When you try to log off a computer that is running Windows Server 2003, Windows XP, Windows 2000, or Windows NT 4.0, one of the following event messages in the Application log are a symptom of a user profile error.

Note An event message can result for many reasons. When you receive an event, confirm that it has the same description every time. This will help you determine whether the event is caused by a user profile error.

How to view the Application log

To view the Application log, do the following:

1. Click Start, and then click Run.
2. In the Open box, type the following text, and then click OK.
   
   eventvwr.msc
3. In Event Viewer, click Application.

Windows Vista and Windows Server 2008

The functionality of UPHClean (v1.6) is included in the Windows Vista and Windows Server 2008 User Profile Service. The User Profile Service performs all the necessary work to prevent user profile log off errors from occuring.

When the User Profile Service takes action to prevent a user profile from unloading, it logs event 1530.

Event Type: Error
Event ID: 1530
Task Category: None
Level: Warning
Description: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

Windows XP and Windows Server 2003

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1517
Description:
Windows saved user ComputerName\UserName registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use. This is caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1524
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Description:
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.
Details:
------------------------------
Access is denied

Windows 2000

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Description:
Windows cannot unload your registry file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
Details:
------------------------------
Access is denied

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Description:.
Windows cannot unload your registry class file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
Details: -
-----------------------------
Access is denied

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Description:
Windows cannot log you on because the profile cannot be loaded. Contact your network administrator.

Windows NT 4.0

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Description:
The operating system was unable to load your profile. Please contact your Network Administrator.
Details:
------------------------------
Access is denied.

How to uninstall the User Profile Hive Cleanup service

1. Click Start, and then click Run.
2. In the Open box, type the following text, and then click OK.
   
   appwiz.cpl
3. In Add/Remove Programs, click User Profile Hive Cleanup Service, and then click Remove.
4. Click Yes.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.