User Profile Hive Cleanup Service For Windows XP / 2000

On Windows 2000 the service deals with application event log event 1000 from source Userenv where the message indicates that the profile is not unloading and the error is "Access is denied". On Windows XP and Windows 2003 the equivalent events are 1517 and 1524 from source Userenv.

To accomplish this the service monitors for logged off users that still have hives loaded. When that happens the service determines which applications have handles opened to the hives and releases them. It logs the application name and what registry keys where left open. After this the system finishes unloading the profile.