1.

Solve : Temporary Profile when logging on?

Answer»

System I have been running without a rebuild since January 2013 today surprised me with upon selecting my profile and logging on it started with a Temporary Profile....

I immediately logged off and back on and my correct profile came up and no problems detected since.

Went into Windows Event Logs and there is an entry with this info:

Quote

Windows detected your registry file is STILL in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1559733504-2109954015-1676233374-1001:
Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-1559733504-2109954015-1676233374-1001


XML View shows this info with EVENT_HIVE_LEAK catching my eye.
Quote
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2016-02-19T21:45:35.961000000Z" />
<EventRecordID>38335</EventRecordID>
<Correlation />
<Execution ProcessID="1336" ThreadID="2540" />
<Channel>Application</Channel>
<Computer>Athlon4450B</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-1559733504-2109954015-1676233374-1001: Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-1559733504-2109954015-1676233374-1001</Data>
</EventData>
</Event>

Online I didnt find anything helpful as to why this happened as for my system still has its profile there and no corruption detected. Nervous that it could have been a hard drive FAILURE I ran crystaldiskinfo and both hard drives show healthy. This morning when shutting the system down it shutdown normal. Additionally the desktop system is protected by being powered off of a battery backup so no dips or low voltage conditions from power to home would affect a write to hard drive etc.

Figured I'd share this here to see if anyone has SEEN this before to know the exact cause. First time its happened and hopefully it wont happen again, but I am going to backup my important data off of the 750GB HDD as for thats the one that the profile is located on and the one that gets battered by heavy write cycles from FRAPS regularly for 30 minutes to 2 hours at a time when recording VIDEO game events.

Attached is a screenshot from event viewer which pretty much shows same info that I pasted above.

Here is Microsofts hit on this that isnt much help: http://answers.microsoft.com/en-us/windows/forum/windows_7-security/being-logged-in-to-windows-7-with-a-temporary/95a4689d-e5b8-43b7-8fee-e87a01ae7acb?auth=1


[attachment deleted by admin to conserve space]The "hive leak" from what I understand is when a program has a registry handle open to your user hive when you log off or switch users. probably not related to how it logged into a temporary profile. There should be a log entry something like "Windows cannot find the local profile and is logging you on with a temporary profile."

Since you can log-in to the profile without ISSUE now it would appear to be related to a background program such as an AV (which runs under the local system account) happening to be looking at a registry key or file that Windows needed to use to log-in. It couldn't access it so freaked out and just used a temporary profile.Thanks for the info BC


Discussion

No Comment Found

Related InterviewSolutions