Link to home
Start Free TrialLog in
Avatar of aldo27
aldo27

asked on

Event IDs 1500 and 1508 - Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

Ok, I'm in desperate need of getting this issue fix cause is affecting two labs that students use.

I have about 60 Wyse Terminals that RDP to a Windows 2003 Terminal Server - 4CPU 3ghz w/ 4gigs of ram.  The server has been updated with all the patches and I've also tried adding the unload profile utility from Microsoft which did not help me out.

This morning the students got Event ID 1500 along with 1508:

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1500
Date:            1/30/2006
Time:            2:42:47 PM
User:            DORRISEATON\Student3
Computer:      DESTSVR
Description:
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.

 DETAIL - Insufficient system resources exist to complete the requested service.  


Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1508
Date:            1/30/2006
Time:            2:42:46 PM
User:            NT AUTHORITY\SYSTEM
Computer:      DESTSVR
Description:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

 DETAIL - Insufficient system resources exist to complete the requested service.  for C:\Documents and Settings\student3\ntuser.dat

The server has been up since for over 8 months, but this problem just started happening.  I've checked replication between the server the host the profiles and I can't find any errors to give me a clue. I thought it might be a chance I made on a GPO for the students (restrict access to A, B, C and D) but this doesn't seem to affect them.  I turn off and on, and was unable to replicate the issue.

If you've dealt with this type of problem in this type of env., your help is greatly appreciate it.

Thanks
Avatar of MiguelSilvestre
MiguelSilvestre

Avatar of aldo27

ASKER

Thanks Miguel, but I already went thru the info on EventID.net and none of the info helped me out. That's where I initially began to look to resolve my problem.
4Gb of memory is certainly a hefty amount of RAM, can you check to the memory usage for me though, you may have a chip or even multiple that is not performing - check to make sure your not currently maxed out
Avatar of aldo27

ASKER

So far it has never gone over 1.5 to 2gigs.  The system is not really being pushed..

I've had a few processes push the processors to 25% but that's about it.

hmm i have been doing a stack of reading on it but you say you have already tried the event ID site, there was one link that i looked at that had some registry settings, but they seemed to have been pulled from eventid.net so i wont throw them at you if you have already looked + the microsoft links were dead now anyway    very odd man, ill keep reading for you
Avatar of aldo27

ASKER

I went thru all the Userenv items that EventID had listed and thru some of those links I found the unload profiles. I thought this was going to do it, but the error came back today.  Everything seems to worked for about 4 days.

Usually I'm able to find an answer to a problem thru the usual means of Eventid, here and just going to whatever google has index, but this one has me stumped.

Today there was about 15 people already logged on to the server, then 18 students were denied access as they also tried to  login.  It was a long row of 1500/1508s..

I really hope someone has run in to this issue before and knows what the problem is.
Avatar of oBdA
Are you using the /3GB switch in boot.ini? If so, remove it.
Avatar of aldo27

ASKER

No switch.. Today everyone is able to log in but only because I rebooted the server last night.  I could setup a task to reboot the server every night but I think the problem will eventually come back.
Hi all,

Last post on this topic dates from 1/31/06; Aldo, did you manage to solve this problem or is it still going on ?

I have exactly the same problem at a customer's server; OS: windows 2003 SP1.
Same events in eventviewer; found some info at Eventid.net about them, but not enough to solve the problem.

Definately would like to know if you or anyone else was able to solve the problem!

Many thanks in advance.

Cheers,
Robert
Avatar of aldo27

ASKER

Hi Robert,

I wish I could tell you that the problem has been fixed but it's still ongoing.  My current workaround is to reboot the server every 3 days, that's the only thing that seems to temporarily fix the problem.

I did find this solution in the google groups which you might want to try out - this applies to sid issues.  If this doesn't apply to your problem like it did with me and you find a different solution, please let me know.  I would really like to get this resolved...

Good luck!
Aldo


---------------------------------------------------------------------------------
The solution i got from MS Support worked for 1500/1508

Here are the detailed steps.

1. Download and install the Resource Kit.
2. Find the file acctinfo.dll, it should be in c:\program
files\windows resource kits\tools\.
3. From the command promt type regsvr32 "path to the
file\acctinfo.dll"
4. Open Active Directory Users and Computers and find a
users that is affected by the problem.
5. Right klick the user and select properties, and choose
Additional Account Info. Here you will find the SID for
that user. Make a note of the SID.
6. Run regedit and browse to the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList. Search for the SID you made
a note of, and look for the value in ProfileImagePath.
7. Use the search function and look for the value in
ProfileImagePath.
8. If you find the value somewhere else, export it to
a .reg file and then delete the key in the registry.
9. Repeat steps 4-8 for any other affected users.
10. Reboot the server.
Hi,

It seems that we solved this problem with our client.
We logged a ticket with Microsoft and they came up with http://support.microsoft.com/?scid=kb;en-us;823586&spid=2488&sid=702

Problem was that a certain process, called ctfmon.exe (office 2003)  was taking a lot of resources and was active like 40 times (1 for every user)

We followed above kb, but this didnot solve it; Micorosoft found this very strange.
They gave us a hint however, to change the ntfs permissions on the ctfmon.exe file by denying access to users.

This finally solved the problem!
Hope you will benefit from this solution as well.

Regards,
Robert.
global-e,

Thanks for coming back and telling us how you resolved the issue - it is much appreciated!

I change my recommendation to;

PAQ - Refund

-red
EE Cleanup Volunteer
red,

that wasnt the author :)
In that case, I am a fool :)

Thanks Jay_Jay, for the daily shot of self confidence :))

In THAT case, my recommendation will still change and be PAQ - Refund

-red
EE Cleanup Volunteer
Forgive me my ignorance, but what is PAQ - Refund ?


Cheers,
Robert
Ah man there was nothing meant in my comment :) just a bit of a laugh, i thought the same thing when i saw the answer that was given :)

Cheers Keiren
global-e,

PAQ - Refund, basically means that the question is closed, the thread is saved for future reference, and the asker gets their points refunded.


Jay,

It is ok man, just felt stupid!

-red
ha! should see one of my cleans lately - 3 different reccos. who feels stupid now!

Red,

Don't really care, but thought one would earn points when one solves a question.
We solved it, also with help op MS, but and the end we solved the problem.

Cheers
the idea is to solve the quetioners question :)
I think it will solve the questioners problem. :)

global-e,

That is the idea, but while you solved a *similar* problem, there is no way to tell that the asker has the same problem, and even if they do, that the solution that worked for you will work for them.

But, you did have information from a similar problem, with a solution, which is why I recommend that this thread be saved for future reference.

-red
cool thanks.
No worries.

I understand your position, there is a chance that your solution will also be THE solution, but without the asker coming back and clearly saying that - we wont know.

Your time was not wasted though, just think of the next poor soul that has the same problem you did, and how happy they will feel when they read your solution and solve their problem.

Karma, Chi, whatever - it is all good :)

-red
Avatar of aldo27

ASKER

Hi,

Thank you for your posting.  So if I understand correct, anybody that logged in to the term server would have an instance of ctfmon running per their user id, right?  That's not the case with mine, I have 8 users at the time of writing this email and only two of them have an instance of ctfmon.  So I'm not 100% sold that this might be the same problem I have, but I'll check the server when there's a heavier load and report back.  I'll uninstall the feature this evening and I'll skip my Wednesday reboot (the server gets rebooted every wednesday and sunday in order to avoid this issue).  If I don't get any 1500/1508 errors within 5 days, this issue will have been fixed by global-e.  Thanks.

Aldo
I do think its the same issue and solution.
Advise to apply the MS article, but also to limit the ntfs permission on ctfmon.exe for only access to the administrator.

Good luck!
ASKER CERTIFIED SOLUTION
Avatar of GranMod
GranMod

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
OMG Experts!
4 years to the day (of the Mod's post), I come across this.  The posts describe my issue to the tee and I hope the solution works for me as well.  My 'go-around' is (has been) reboot the server.  I recently got so fed up, I decided I was going to fix this....once and for all (with high hopes, of course).  Now I actually see a light at the end of the tunnel.

Hugh thanks for keeping the threads all these years.
 
Signed,
Desparately Seeking Solutions
aka zemarc