Slow logon and event log warning since installing XP Service Pack 2

Since installing XP Service Pack 2 it takes longer than usual to load
my personal settings at startup and render the desktop icons. Also, I
get the following warning in the applications event viewer whenever I
shut down or restart the computer. I have not installed any new
hardware or software:

__________________________________________________ _________

Date: 12/4/2004 Source: Userenv
Time: 11:34:47 PM Category: None
Type: Warning Event ID: 1517

User: NT AUTHORITY\SYSTEM
Computer:

Description:

Windows saved user [computer name]\[username] registry while an
application or service was still using the registry during log off.
The memory used by the user's registry has not been freed. The
registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.
__________________________________________________ _________

I checked Local Services and found that the Remote Procedure Call
(RPC) properties shows "log in as" NT Authority\NetworkService. RPC is
set on automatic startup, as is the WebClient service. I don't know
which services might be the problem or which ones can safely have the
"log in as" selection changed. I am the only user of the PC.

I have read postings of users with the same event warning but did not
come across anything initiated by the installation of SP2. Any
suggestions would be most appreciated.

You can look at your running services by using msconfig.exe.(you can disable
one that you think is causing the problem. log off and on, it may not be a
windows service you could then set to run as ...)

I would turn off fast user switching in control panel\user accounts\the way
users log
and see if that can stop the problem.

look here for more inf
http://www.microsoft.com/technet/sup...33&ProdVer=5.2

Warning Error 1517 in Event Viewer after First Restart
http://support.microsoft.com/default...s;810616&sd=ee

Troubleshooting profile unload issues
http://support.microsoft.com/default...s;837115&sd=ee

You can also do a Google search for the bootvis.exe, M$ program.

jim riverman wrote:
> You can also do a Google search for the bootvis.exe, M$ program.

Thanks for the suggestions. I ran Bootvis a number of times and stopped
Fast User Switching, as well as other unneeded services, as suggested.
I still get the warning 1517 in Event Viewer every time I shut down. I
found that disabling all McAfee VirusScan 8 services and startup items
made the error 1517 stop. However, after again enabling VirusScan the
error returned. I regularly update and use VirusScan, Ad-Aware and
Spybot, plus I don't do much web surfing or downloading, so I am
confident there is no virus, worm, syware, etc. running.

After I installed SP2 I noticed that there were some McAfee-related
services that were not present under SP1. Before the SP2 update there
were 5 McAfee start-up items and, as I recall, just one McAfee service.
Now when I look at msconfig I find three McAfee services: McShield,
Security Center Update Manager and VirusScan Onlne Realtime Engine.
This change occurred right after the SP2 install; it was not caused by
a VirusScan update. These services appear to duplicate some of the
McAfee Startup items.

Despite this 1517 warning, whenever I shut down it still takes only 8
seconds for my computer to power off. The slow startup, which I am
guessing might be caused by whatever is causing the 1517 error, remains
a problem. It seems that Windows is taking a long time to load my
personal settings after I log on, plus it takes about 40 seconds before
the log on screen appears. After I log on to Windows it takes maybe
15-20 seconds before the desktop appears and the desktop icons are
rendered slowly. That used to take only about 5 seconds.

The Bootvis log does not show anything out of the ordinary to account
for the slow start-up, and the boot log (Ntbtlog) is normal. However,
the processor is working hard and the C drive is fairly active during
startup. One other observation: since loading SP2, the Bootvis report
does not show the horizonatal bar graph that showed Prefetch and other
activities. So maybe there is something unusual Bootvis is not showing
me.

oopps ! 8 sec to power off ?

the normal default time for window to shutdown is 20 sec.
so 8 sec would be to short for your profile to unload thus causing error
1517 ?


I would suggest increasing the shutdown to it's normal value of 20 sec. and
see if that errors goes away.

How To Increase Shutdown Time So That Processes Can Quit Properly in Windows
XP

http://support.microsoft.com/default...305788&sd=tech

HKEY_CURRENT_USER\Control Panel\Desktop
WaitToKillAppTimeout
value is 20000

( or maybe turn off, reset,an utility or program that you have installed
that causes that fast shutdown)

Other than that you could try to re-install the AV.

********************

Windows is supposed to optimize startup every three days or so in idle time.

If you are technical you can read the document here:

Please scan for virus before opening since it's not an M$ site:

Fast System Startup for PCs Running Windows.doc

http://www.ladava.com/faq/uploads/Fa...%20Windows.doc

You can check if your system file ( Defragment your paging files and
Registry hives) are are frangmented and correct that with:

http://www.sysinternals.com/ntw2k/fr...gedefrag.shtml

try see if it's any help.

Thanks for the response, Jim. I never knowingly installed software to
decrease my boot time and I am pretty sure that since I got the
computer (Dell 4500) it never took over 15 seconds to shut down, and I
never got the 1517 warning before installing SP2. I avoid utilities
that mess with the OS.

Anyway, I went to the registry to set the shutdown to the default value
of 20 seconds as you suggested and found that the WaitToKillAppTimeout
value was already set at the default (20000). I also ran Windows defrag
and the only thing that ends up fragmented is the Master File Table.
The paging file has never been fragmented. I don't know what Registry
hives are but after doing a Google search I found the hivelist. None of
them are fragmented.

I ran PCPitstop and the only "problem" it found was that my C drive has
an "uncached speed" of only 19mb/second right after a defrag. According
to PCPitstop, this is about half the rate that would be expected for
otherwise comparable computers (P4 2.8 ghz with 1GB RAM). Before I
uninstall and reinstall VirusScan or use a third party defragmenter, I
am wondering if the slow drive transfer rate and/or the fragmented
Master File Table (3 fragments) could account for the increased boot
time and the apparently increased time it takes to shut down the
services. And if it is the drive speed, could the SP2 install have
affected it that much? The drive is a Maxtor 7200 rpm Ultra ATA with a
2MB cache. Not state-of-the-art but reasonably fast.

jim riverman wrote:
> oopps ! 8 sec to power off ?
>
> the normal default time for window to shutdown is 20 sec.
> so 8 sec would be to short for your profile to unload thus causing
error
> 1517 ?
>
>
> I would suggest increasing the shutdown to it's normal value of 20
sec. and
> see if that errors goes away.
>
> How To Increase Shutdown Time So That Processes Can Quit Properly in
Windows
> XP
>
>
http://support.microsoft.com/default...305788&sd=tech
>
> HKEY_CURRENT_USER\Control Panel\Desktop
> WaitToKillAppTimeout
> value is 20000
>
> ( or maybe turn off, reset,an utility or program that you have
installed
> that causes that fast shutdown)
>
> Other than that you could try to re-install the AV.
>
> ********************
>
> Windows is supposed to optimize startup every three days or so in
idle time.
>
> If you are technical you can read the document here:
>
> Please scan for virus before opening since it's not an M$ site:
>
> Fast System Startup for PCs Running Windows.doc
>
>
http://www.ladava.com/faq/uploads/Fa...%20Windows.doc
>
> You can check if your system file ( Defragment your paging files and
> Registry hives) are are frangmented and correct that with:
>
> http://www.sysinternals.com/ntw2k/fr...gedefrag.shtml
>
> try see if it's any help.

So far has to 1517 error I looked at my log and I have it too.I did not
notice any slowdown or system problems with it . I think this is caused by
the anti-virus software as I sometimes get a message warning when I shutdown.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 12/11/2004
Time: 22:18:43
User: NT AUTHORITY\SYSTEM
Computer:

I have installed SP2 on my DELL and noticed a slight improvement in speed
,plus a small problem with the mouse that was easily corrected.

As far as the MFT I have also 3 fragments had it before and after SP2 no
effect at all.

Master File Table (MFT) fragmentation
Total MFT size = 58 MB
MFT record count = 39,149
Percent MFT in use = 65 %
Total MFT fragments = 3

SP2 did change my hard drive's driver the disk.sys file.You may want to look
at that in the device manager.The enable write cache option is enabled, that
could effect the drive speed.The other driver that was changed was the
storage volume, volsnap,sys ( to see this go to device manager view \ select
show hidden devices.).

One thing that can effect the speed if your drive is NTFS is indexing.You
can find that in the drive properties and also the indexing service ( CONTROL
PANEL\administrative tools\services it has to started auto.)

An other speed sensitive area for speed is in the c:\windows\prefetch folder.

You may want to do a google seach on that for explanations.
I usually flush that out when there are too many entries (*.pf).The most
important file in there for boot time is layout.ini. Bootvis remake one ( or
window idle time routine) and you usually see an imporvement in speed.

If you want to defrag the disk according to the containt of the layout.ini
file open an cmd windows and
type defrag c: -b

Another improvement utility I use for boot time speedup is
NTREGOPT

http://home.t-online.de/home/lars.hederer/erunt/

That works very well on my DELL.

Other than that you may want to look at
http://www.aumha.org/win5/

shutdown and restart

Fixing another issue caused the Userenv Event 1517 warning to stop
occurring (though it did not reduce the start-up time).

Specifically, when I would click on the Advanced tab in my Local Area
Connection properties I would see the following message:

"Windows cannot display the properties of this connection. The Windows
Management Instrumentation (WMI) information might be corrupted. To
correct this, use System Restore to restore Windows to an earlier time
(called a restore point). System Restore is located in the System Tools
folder in Accessories."

I stopped the WMI service, deleted the contents of the
%SystemRoot%\System32\Wbem\Repository
folder and rebooted. Windows restored the contents of the repository
folder, the WMI problem was corrected and the Event 1517 warnings
stopped. I suppose the Event 1517 was the result of the corrupted WMI
information causing a delay in stopping the WMI service during
shutdown. That's an uneducated guess.