Registry handles leaked?

Question

We're running a Python script (which uses multithreading) to do some work on an Amazon-EC2 based Windows Server 2008 machine. When the machine starts, I can see that it starts executing the Python script, and then I start seeing messages like the following in the event log:

Windows detected your registry file is still in use by other applications or services. The    file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

DETAIL - 
19 user registry handles leaked from \Registry\User\S-1-5-21-2812493808-1934077838-3320662659-500_Classes:
Process 2872 (\Device\HarddiskVolume1\Python27\python.exe) has opened key \REGISTRY\USER\S-1-5-21-2812493808-1934077838-3320662659-500_CLASSES
Process 2844 (\Device\HarddiskVolume1\Python27\python.exe) has opened key \REGISTRY\USER\S-1-5-21-2812493808-1934077838-3320662659-500_CLASSES
Process 2408 (\Device\HarddiskVolume1\Python27\python.exe) has opened key \REGISTRY\USER\S-1-5-21-2812493808-1934077838-3320662659-500_CLASSES

What exactly does this mean, and how do I stop Windows from killing some of the threads?

Answer 1

When a scheduled task is configured to run as a particular user, that user's account is logged on non-interactively in order to run the task. When the task is finished, the user's registry hive is unloaded. For some reason, this is happening prematurely.

From your description, you have a single scheduled task, which launches various subprocesses. It seems likely that the parent process is exiting before the subprocesses are finished, and that this is causing the user's registry hive to be unloaded. You can verify this theory by turning on auditing for process creation and termination (in Group Policy under Advanced Audit Policy Configuration) or by using a tool such as Process Monitor (available from the MS website).

Assuming this is the cause, the fix is for the parent process to wait for the subprocesses to exit before itself exiting; alternatively, depending on your circumstances, it may be sensible for the parent task to simply never exit.

If you don't have direct control over the relationship between the parent process and the subprocesses then you'll need to create a new parent process to launch the script for you, and then either wait for all subprocesses to complete or sleep forever, as appropriate.

Answer 2

It may be that some your files are corrupted. Try the following:

Perform SFC(System file Checker) scan and see if it helps.

1. Press Windows key + X.
2. Select Command Prompt(Admin).
3. Type sfc /scannow and hit enter.

Also perform a chkdsk:

1. Press Windows Logo + C to open the Charms bar.
2. Now click Settings and then More PC Settings.
3. Now click General and then click Restart Now under Advanced Startup.
4. Now Click Troubleshoot.
5. Now click Advanced options and select Command prompt.
6. Type chkdsk /r and hit enter.

Last but not least, if the above doesn't work, you can perform a startup repair:

1. Press Windows logo + W to open the search box.
2. Type Advanced Startup options, hit enter.
3. Then Click Restart Now under Advanced Startup.
4. Now Click Troubleshoot.
5. Then click Advanced options and then Automatic Repair.

Hope it helps.