Registry bloat causes slow logons or insufficient system resources error 0x800705AA in Windows 8.1

Symptoms

Cause

These issues occur because WNF registrations entries in the Notifications registry subkey are leaked, and this causes registry bloat.

Leaked WNF registrations cause the Explorer.exe process to read many registry values from the notification registry subkey when the system initializes the process. Lots of WNF registrations can delay user logon and increase CPU usage.

Additionally, the 0x800705AA error may occur when the BackgroundDownloader class tries to allocate a WNF state name and fails.

How to obtain this update

Important Do not install a language pack after you install this update. If you do, the language-specific changes in the update will not be applied, and you will have to reinstall the update. For more information, see Add language packs to Windows.

This update improves performance when system initializes the explorer.exe process.

Update detail information

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

See the terminology that Microsoft uses to describe software updates.

More Information

Additional steps for configurationWe recommend that you install this update through Windows Update as doing this installs the fix and removes the leaked registrations.

If you download the package directly from the Microsoft Download Center, you have to manually extract the wnfcleanup tool from the MSU package. To extract the cleanup tool from the MSU package by opening an elevated command prompt by using Run as administrator, run the following commands in order:

MD c:\wnfcleanup
Copy %userprofile%\Downloads\Windows8.1-KB3063843-* c:\wnfcleanup
CD \wnfcleanup
expand Windows8.1-KB3063843-*.msu -F:wnfcleanup.exe .\

Note The full stop (.\) is important as it says to extract the EXE to the current location where the MSU is.

Then, create a scheduled task to clean up the existing registry entries by running the wnfcleanup.exe tool as SYSTEM.
The following commands should be run in an elevated command prompt to create a scheduled task. The task executes a command as SYSTEM to run the cleanup tool. Then, the task is deleted.

SCHTASKS /create /f /SC hourly /TN Wnfcleanup /TR "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" /RU "SYSTEM" 
SCHTASKS /run /I /TN "Wnfcleanup"

Note "c:\wnfcleanup\wnfcleanup.exe" is a location that is used in this example. You should modify this to reflect the exact drive and path where the wnfcleanup tool was extracted to if you did not follow the earlier instructions exactly.

Now leave the system for several minutes so that the task can execute and be completed. You can check the status of the Wnfcleanup task to see whether it has completed and returned to the "ready" state by running the following commands:

SCHTASKS /QUERY /V | findstr /I "wnfcleanup" > .\cleanup.txt
Cleanup.txt

Note The Cleanup.txt should show a status of "Ready." If it shows as "Running," rerun the two commands above. As soon as the status shows "Ready," locate "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" in the Clanup.txt.  Immediately to the left is the result code that is followed by the account name which created the scheduled task.  It will be as follows "0 Administrator." The result code should be "0" that indicates the task ran successfully.

As soon as it is completed, delete the task:

SCHTASKS /delete /TN "Wnfcleanup" /f

You can now delete the c:\wnfcleanup directory that you created and its contents.

Note The wnfcleanup tool must be run in the SYSTEM security context. This is why the task scheduler is used. Or, you could run it by using a tool such as PsExec.

About Windows Push Notification Platform Windows Push Notification Platform is a component that exposes a notification sink to notify of notification changes, and an API to communicate how to interact with the notifications.

About Windows Notification FacilityWindows Notification Facility is an infrastructure for secured publish-subscribe messaging among kernel components, system services, and user-space applications.

When you try to register for a notification to a new state name, there will be a potential access to the registry. All state name definitions are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications.