EventID1530 on server 2008 r2 sp1

Hi,

I'm seeing eventid 1530 in App log on w2k8 r2 sp1 box running  citrix xenapp 6.5 everytime user(s) log off. I've read few articles about this issue, should i be concerned? I've tested it in our test lab and after reconnecting back I haven't noticed any issues. All printers are mapped back and I can use them without any issues.

i'm familiar with following articles:
http://support.microsoft.com/kb/947238
http://support.microsoft.com/kb/980408


 DETAIL -
  1 user registry handles leaked from \Registry\User\S-1-5-21-1770385481-4272976326-2274647878-1032:
 Process 1244 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1770385481-4272976326-2274647878-1032\Printers\DevModePerUser

any other suggestions?

ty
pw
publicworksAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dirk KotteSECommented:
while deleting the user-profile are open handles detected.
this should not be a problem mostly. Its a warning only.
many times this raised by symantec endpoint protection.
there are a possibility of data-loss if the file are not written - but this registry-key are uncritical.
you should not be concerned because this.

if you detect some critical errors you can switch to the citrix UserProfileManager.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
publicworksAuthor Commented:
hi dkotte,

thx for your reply. i've cupm 4.0 configured on all citrix servers and yes we do run SEP 12.1 on all servers. I know its only a warning so it shouldnt be a that much of big deal but with citrix one never knows. for example, when i install Xerox UPD on citrix box i do get more of those warnings, like one below:
Process 8864 (\Device\HarddiskVolume1\Program Files (x86)\Citrix\system32\CpSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-2129660284-1997560955-905330997-340192\Software\Xerox\PrinterDriver\V5.0\NamedSettings\UNIV

actually, i tested it and havent had any xerox printer problems. however, with xerox upd i can always uninstall it and use citrix upd. would be interesting to see if i get those warnings without SEP.
ty
pw
0
Seth SimmonsSr. Systems AdministratorCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Citrix

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.