Event ID: 1524/1517

[Adam_Webclients]

This is not an urgent issue:

I have a server running backup exec 12.5.  It backs up a lot of stuff for us from a central file server.  On my file server's application log (windows 2003), I get Event ID: 1524/1517 every night at 9:15PM.

User: BackupService

Event ID 1524: Windows cannot unload your classes registry file - it is still in use by other applications or services.  The file will be unloaded when it is no longer in use.

User: SYSTEM

Event ID 1517: Windows saved user FILESERVER\BackupService registry while an application or service was still using the registry during log off.  The memory used by the user's registry has not been freed.  The registry will be unloaded when it is no longer in use.  This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

It seems to me like it may be a bug in coding on either microsoft or symantec's side??

Any pointers?

.:edit:.

I did read about a program called UPHclean by microsoft which seems to be the answer, but I'd like some feedback first.

[VJware · Accepted solution]

Verbatim:

The application event IDs 1000, 1500, 1517, 1524 are logged in the Application log. Viewing events in the Application log is the most accurate method to determine user profile unload errors

Take a look at - http://support.microsoft.com/kb/837115 which provides details about these events being logged

[Adam_Webclients]

Alright guess UPHclean is the way to go then...  I'll probably apply the fix sometime this week after I run it by my boss.  I'll give an update to let you guys know if its success or fail.

[Adam_Webclients]

I don't think this is the correct way to go about this problem.

I looked through the Backup Exec Logon Account Management console, and I saw the the "System Logon Account" was set to outdated user creds from the old domain before our company was bought out.

Basically, there is no access to that old password, and it seems like I can't free up the system logon account and add a current AD user to it.

The Userenv errors are directly related to the BackupService account that was created after the move.

My question:  Is there a way to replace the user account without that password short of reinstalling backupexec?

[VJware]

You should be able to create a new BE logon account & then replace the new one as the default one...

http://www.symantec.com/docs/HOWTO22456

[Adam_Webclients]

We already have a backup account in place, "backup service".  I assume that using the system logon account may fix the problem.  It's really not a big deal I just hate seeing 2 warnings pop up daily in my otherwise spotless eventlog, lol.

Thanks for your help but I think I'll just leave this one go.  Sounds like more trouble than its worth.

[Adam_Webclients]

FYI, UPH clean fixed it.