1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

XP SP2 "Reality Check" 4Me: Userenv Event ID: 1517

Discussion in 'Windows XP' started by Rollin' Rog, Mar 13, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I've been investigating an "applications" eventlog error occurring since upgrading to XP SP2 and would appreciate anyone else with SP2 checking to see if they are experiencing the same error.

    Instructions:

    1 > go to Start > Run, enter eventvwr.msc and open the "Applications" log.

    Do you see the following type error repeatedly:

    If so, go here and install the "User Profile Hive Cleanup Service"

    http://www.microsoft.com/downloads/...6d-8912-4e18-b570-42470e2f3582&displaylang=en

    2 >> after installing and rebooting a couple of times, go back to the Applications log and look for:

    Do you see that issue occuring with "svchost.exe" Your PID for svchost.exe will vary (mine was 724, but this can vary as well)


    Let me know I'd like to ask you to try something else. On my system this PID of svchost.exe ran two services "termservices" and "dcomlaunch" -- they are somewhat related.

    It appears that temporarily disabling "termservices" and rebooting a couple of times, eliminates the error when the service is later set back to manual. But I'm still watching this.

    When rebooting with it disabled I did not see the Security Center "sheild icon" in the system tray.
     
  2. crjdriver

    crjdriver Moderator

    Joined:
    Jan 2, 2001
    Messages:
    37,952
    I checked my event viewer and did see that error a few times. I have had no problems at all however; no error msg, etc everything seems to be working fine.

    XP pro installed with slipstreamed sp2.
     
  3. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I actually hadn't looked at the "Applications" log since upgrading to SP2 in late February. What motivated me today was a "Bad_Pool_Caller" stop message on bootup. It hasn't repeated -- but I was looking for anything that might be involved.

    In any case if you are getting the error I'm referring to, its: Event ID: 1517 and none other. And it may repeat every shutdown.
     
  4. crjdriver

    crjdriver Moderator

    Joined:
    Jan 2, 2001
    Messages:
    37,952
    I cleared the event log and I will reboot the system and check if it is there.
     
  5. crjdriver

    crjdriver Moderator

    Joined:
    Jan 2, 2001
    Messages:
    37,952
    Rebooted and no error in event viewer. I only had that error a few times in EV.
     
  6. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Thanks for checking it out; I'm still puttering around compulsively checking. I've disabled UPHCS for a bit to see if it begins again. I don't think the "warning" ever caused any problems, but one way or another I want to get rid of it.
     
  7. LauraMJ

    LauraMJ Administrator

    Joined:
    Mar 18, 2004
    Messages:
    13,157
    I've gotten that error message too. I also checked the event viewer because of an error I get on boot up every 5 or 6 boot ups or so. Mine was not a "bad spool" message, though but a black screen that said that windows could not load because of a missing/corrupt system32 config file (or something along those lines). I reboot, and everything is fine, but I though I'd check out the event viewer. (talk about compulsively checking things, I've got a shortcut to my event viewer on my desktop, lol). So, several days ago, I tracked down that "Hive Cleanup" thingy and installed it, since I WAS having a somewhat long shutdown time. And while it fixed the long shut-down problem, just this morning I once again got that error *sigh*.

    Anyway, checking for your next event viewer item, yes, I get the UPHClean event of svchost.exe (my number is 692 on this, though) Upon the next shutdown, I got the same event, though the number changed to 684. For the shutdown after that, there was no UPHClean event, then the one after that had UPHClean event of svchost.exe with the number of 688. One final shutdown UPHClean event with a number of 684 again. That is all the shutdowns I've done since installing it.
     
  8. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    You are lucky you've been able to reboot getting that corrupt system32 config error. Often it is not recoverable save for a very complex method of restoring original registry hive files and then doing a System Restore.

    There is a way of seeing what services svchost.exe is running and associating them with the particular PID.

    What I've used is tasklist.exe -- it is default installed in XP PRO but must be downloaded if you have home.

    From a command line you can run:

    tasklist /svc

    or:

    tasklist /svc /fi "imagename eq svchost.exe"

    It can be downloaded from here:

    http://www.computerhope.com/download/winxp.htm

    It should go to the system32 folder.


    However, I'm wondering if we are perhaps both victims of a bloated registry. While I have a morbid fear of registry cleaners, I'm seriously thinking of running one and/or removing unneeded programs from Add/Remove programs.


    You might want to take whatever steps are necessary to ensure you have appropriate backups, because I consider that "config" error somewhat ominous. Drive checking and ram checking utilities would also be in order.
     
  9. LauraMJ

    LauraMJ Administrator

    Joined:
    Mar 18, 2004
    Messages:
    13,157
    I have rebooted that error........oh........6 or 7 times now. It only happens occasionally. it will boot up fine 6 or 7 times in a row, then give that error. Alway, (so far) I simply reboot and it is fine. The funny thing is that I've never had that error till I installed SP2. I had a DIFFERENT error, a PFN_LIST_CORRUPT error quite a lot BEFORE SP2, which no longer happens, lol, but now every so often I get that black screen error. If it ain't one thing it's another........

    I have run the chckdsk /r option from the recovery console a couple of times, but the error eventually comes back.

    I have XP PRO, do you want me to run that tasklist.exe and post the results?

    I cannot remove anything in the add/remove program list, I usually keep that pretty cleaned up, anything that is in there is what I actually do use or need.

    I have 384 mg of RAM, though I have been considering getting more. The harddrive is fairly new, less than a year old. I've heard people talk of those registry cleaners, but I've never used one, been rather afraid to, really.
     
  10. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Yeah, try running:

    tasklist /svc /fi "imagename eq svchost.exe"

    It will be specific to svchost.exe and will save you wading through a lot of other tasks.

    Then see if you can assoicate one of the PID numbers there with the ones you see in Event ID: 1201

    I'm curious if it is the same ones I get.

    Have you had any of those "config" errors since installing UPH cleaner?
     
  11. LauraMJ

    LauraMJ Administrator

    Joined:
    Mar 18, 2004
    Messages:
    13,157
    Sorry it took so long to get back to you. Sick kids, Dr. appts, ect.......

    When I try to run that line you gave: tasklist /svc /fi "imagename eq svchost.exe" the command box just pops up for a split second and disappears. This means that the command prompt is not recognized, doesn't it? I tried both with the quotation marks, and without.

    And yes, the Config error happened today, as a matter of fact. First thing this morning, it booted fine. Then I shut it off since I was going to be gone for quite a while, and this afternoon when I booted, it gave that error. I rebooted, then got a second, blue-screen error basically said the same thing, though for the life of me I can't remember the exact error. So, I booted with the CD and did a chkdsk /r from the recovery console. After that, it worked.

    Ocassionally, I also get a black screen that says "sorry for the inconvenience, but Windows did not start properly....." and it gives me three options. I always just choose "start Windows normally" and it always boots right up.
     
  12. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Did chkdsk tell you it repaired anything? It is sounding like a hardware issue for you. Could be anything from a bad drive to weak power supply. As for ram, you could probably use more, but the issue is whether what you have is faulty.

    To run the tasklist command you must do it from a command prompt (start > run: cmd

    If you do it from "Run" then you get what you got. Sorry if I didn't make that clear, I thought you had already run tasklist /svc that way.

    ...

    Anyway, to carry on further here (I just did another "restart") I'm still trying to sort out which svchost/PID is involved here. It's being onry with me now and not giving me ID 1201 entries to look at.

    The problem is that UPH clean does its thing on shutdown, but the PID for Svchost.exe changes when you restart. So you really have see what is there before you shutdown/restart and then look for that Event ID 1201 with UPH clean to see what the PID is there.

    I think it's got to be the one with the largest number of handles and memory usage, because that is the one where the HKCU key is that is not closing.

    I'm using "Process Explorer" to look at handles and PIDs, for what it's worth.
     
  13. LauraMJ

    LauraMJ Administrator

    Joined:
    Mar 18, 2004
    Messages:
    13,157
    I had the power supply go out a few months ago, and got a new, bigger one. I would hope that is not it. [​IMG]

    [​IMG]

    Okay, when I do it the RIGHT way, I get:

    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.

    C:\Documents and Settings\Laurah Martlock>tasklist /svc /fi "imagename eq svchos
    t.exe"

    Image Name PID Services
    ========================= ====== =============================================
    svchost.exe 692 DcomLaunch
    svchost.exe 772 RpcSs
    svchost.exe 812 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
    ERSvc, EventSystem, helpsvc, lanmanserver,
    lanmanworkstation, Netman, Nla, RasMan,
    Schedule, SENS, SharedAccess,
    ShellHWDetection, srservice, TapiSrv,
    Themes, W32Time, winmgmt, wscsvc, wuauserv
    svchost.exe 864 Dnscache
    svchost.exe 916 LmHosts, WebClient
    svchost.exe 1620 stisvc



    Does that help?

    Edited to add.......Hmmm....that didn't copy and paste quite right, lost the columns, but I think you can still see what's what.
     
  14. LauraMJ

    LauraMJ Administrator

    Joined:
    Mar 18, 2004
    Messages:
    13,157
    Oh, and yeah, the chkdsk did say that it found and fixed one or more errors. It always says that, when I run it for this problem. And it always said that when I ran it for the PFN_LIST_CORRUPT BSOD I used to get before SP2.
     
  15. Rollin' Rog

    Rollin' Rog Thread Starter

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Interesting you don't have TermService there with Dcomlaunch. When I disabled that I lost the "sheild" icon for Windows Security Center in the "notifications" area (system tray)

    I think it's either going to be the svchost.exe associated with that, or the "biggie", currently PID 812 in your current list. I'm sure it will change from boot to boot.

    You have to look at this before restarting to note the PIDs then see what crops up in the ID 1201 error.

    Whether it means anything I don't really know.

    How to Troubleshoot a "STOP 0x0000004E PFN_LIST_CORRUPT" Error Message

    Here are a couple of utilities, you just create a boot floppy with them, and then, as long as you have the floppy disk first in the BIOS boot order, you boot with them and let them do there thing for a while. They should be through at least one full pass in a half hour or so. Remove the floppy and ctrl-alt-del to reboot.

    http://oca.microsoft.com/en/windiag.asp

    http://www.memtest86.com/

    http://support.microsoft.com/kb/291806/EN-US/
    http://www.osronline.com/article.cfm?id=334
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/340657

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice