Warning error 1517 in Event Viewer after first restart

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article has been archived. It is offered "as is" and will no longer be updated.
After you run Sysprep on an installation of either Windows XP Professional or Windows XP Home Edition, the following warning message may be displayed in the application event log when you restart the computer:

Event Type: Error Event
Source: Userenv Event
Category: None
Event ID: 1517
Date: 01/18/01
Time: 10:41:52
User: NT AUTHORITY\SYSTEM Computer: <computer name>
Description: Windows saved user <domain\user> registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. This is often caused by services running as a user account, try configuring the services to run in the local system account.

The event occurs if a program or service has the Registry open while Windows XP is logging off.
You do not have to do anything. You can ignore the warning.
This behavior is by design.

Article ID: 810616 - Last Review: 12/08/2015 01:42:31 - Revision: 2.1

Microsoft Windows XP Professional, Microsoft Windows XP Professional SP1, Microsoft Windows XP Professional SP2, Microsoft Windows XP Home Edition, Microsoft Windows XP Home Edition SP1, Microsoft Windows XP Home Edition SP2

  • kbnosurvey kbarchive kbprb KB810616