normanml
asked on
Registry leaks from external hard drive
On my machine WIN7/64, I have a G-Tech mini 500 external hard drive connected by USB. It supplies enough power and I do not have to use the power adapter.
Using Diskpart, I've ID'd the the G-Tech disk as Volume3.
For a while, regularly, I've been getting the following 1530 event in Admin events:
15 user registry handles leaked from \Registry\User\S-1-5-21-29 87587682-1 074968332- 1067063631 -1001:
Process 2476 (\Device\HarddiskVolume3\P rogram Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-29 87587682-1 074968332- 1067063631 -1001
Process 2476 (\Device\HarddiskVolume3\P rogram Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-29 87587682-1 074968332- 1067063631 -1001
Process 2476 (\Device\HarddiskVolume3\P rogram Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-29 87587682-1 074968332- 1067063631 -1001
Process 2476 (\Device\HarddiskVolume3\P rogram Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-29 87587682-1 074968332- 1067063631 -1001
I did not list all 15 events, which are the same, but you get the idea. I've been getting Volume 3 (G-Tech mini) events for quite a while. The number of handle leaks varies, but they are always the same, same volume, same registry key, most especially, same WLIDSVC.EXE interacting with a hard drive that is used for nothing but storage.
Again, I repeat, no programs run from the G-tech; it's just used to backup data files. Why then would it generate so many 1530's involved with Windows Live, which I never use? How does Windows live get involved with an external hard drive? Most of all, what can I do to stop the 1530 events (yes, I know, they are harmless but they fill my admin logs.) And this always occurs at shutdown.
Thanks.
Using Diskpart, I've ID'd the the G-Tech disk as Volume3.
For a while, regularly, I've been getting the following 1530 event in Admin events:
15 user registry handles leaked from \Registry\User\S-1-5-21-29
Process 2476 (\Device\HarddiskVolume3\P
Process 2476 (\Device\HarddiskVolume3\P
Process 2476 (\Device\HarddiskVolume3\P
Process 2476 (\Device\HarddiskVolume3\P
I did not list all 15 events, which are the same, but you get the idea. I've been getting Volume 3 (G-Tech mini) events for quite a while. The number of handle leaks varies, but they are always the same, same volume, same registry key, most especially, same WLIDSVC.EXE interacting with a hard drive that is used for nothing but storage.
Again, I repeat, no programs run from the G-tech; it's just used to backup data files. Why then would it generate so many 1530's involved with Windows Live, which I never use? How does Windows live get involved with an external hard drive? Most of all, what can I do to stop the 1530 events (yes, I know, they are harmless but they fill my admin logs.) And this always occurs at shutdown.
Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
So far disabling Windows Live ID Sign-in Assistant seems to work, this instead of uninstalling WL components. And thanks Rindi for an explanation I've seen no where else. I'm guessing there are legions of Win Opsys owners out there who think that :"Volume3" is the same as disk 3 in the disk management list. I did and was baffled the interaction between an ext HD and WinLive components. Anyway, we'll see what happens with WL ID Sign-in service disable. Thanks to all.
You might try uninstalling Windows Live Essentials. To do this uninstall from the 'Programs and Features' in Windows 7, select 'Remove', and 'Yes' to confirm. Then start regedit (assuming you're backed up safely, etc) and look for HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\ Windows\CurrentVersion\ Uninstall
On the right pane, locate the registry key which contains 'Windows Live Essentials'. Look for the key Uninstall Windows Live Essentials. The log file is located on the same folder where the software resides. Delete the key containing “Windows Live Essentials”.
You'll need to reboot but Live Essentials will be gone and you should get rid of those 1530 Warning messages.