Warning error 1517 in Event Viewer after first restart

Article translations Article translations
Article ID: 810616 - View products that this article applies to.
Expand all | Collapse all


After you run Sysprep on an installation of either Windows XP Professional or Windows XP Home Edition, the following warning message may be displayed in the application event log when you restart the computer:

Event Type: Error Event
Source: Userenv Event
Category: None
Event ID: 1517
Date: 01/18/01
Time: 10:41:52
User: NT AUTHORITY\SYSTEM Computer: <computer name>
Description: Windows saved user <domain\user> registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. This is often caused by services running as a user account, try configuring the services to run in the local system account.


The event occurs if a program or service has the Registry open while Windows XP is logging off.


You do not have to do anything. You can ignore the warning.


This behavior is by design.


Article ID: 810616 - Last Review: February 12, 2007 - Revision: 2.1
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Professional SP2
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Home Edition SP1
  • Microsoft Windows XP Home Edition SP2
kbprb KB810616

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com