Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Windows Application Log · Event 1530
When you sign out, Windows unloads your part of the registry. If a program still had it open, Windows forces the unload anyway and logs this, naming the process that was holding on. On a personal PC it is harmless; on a shared or remote-desktop server it is how profile corruption starts.
Also written as User Profiles Service 1530user registry handles leaked
A program did not tidy up properly when you signed out. Windows cleaned up for it. Nothing is broken and there is nothing you need to do — this event is one of the most common harmless warnings in the Application log.
On session hosts and Citrix or RDS farms this is the leading indicator of profile problems. The handles named in the event are the ones preventing the hive from unloading cleanly, and repeated forced unloads are what eventually leave a NTUSER.DAT in a state that produces Event 1511 at the next logon. Fix the leaking process rather than enabling the 'do not forcefully unload' policy, which trades a warning for a genuinely stuck hive.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1000000000-2000000000-3000000000-1104:
Process 4820 (\Device\HarddiskVolume3\Program Files\Contoso\syncagent.exe) has opened key \REGISTRY\USER\S-1-5-21-1000000000-2000000000-3000000000-1104\SOFTWARE\CONTOSO\SYNCEverything else in the log line is context.
Most of the time it is one of these.
What gives it awayThe named process is not one you recognise and appears in the same event at every sign-out, often running from a user-writable path such as AppData or Temp.
ATT&CK T1547.001What gives it awayAn unexpected process holding keys under Software\Microsoft\Windows\CurrentVersion or a vendor credential path, on a machine with no reason to run it.
ATT&CK T1552.002Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-User Profiles Service'; Id=1530} -MaxEvents 100 | Select-Object TimeCreated, Message | Format-ListEvent | where EventLog == 'Application' and EventID == 1530 | extend Proc = extract(@'Process \d+ \((\S+?)\)', 1, RenderedDescription) | summarize events = count(), hosts = dcount(Computer) by Proc | order by events descwevtutil qe Application /q:"*[System[Provider[@Name='Microsoft-Windows-User Profiles Service'] and (EventID=1530)]]" /c:20 /rd:true /f:textOn a home or single-user PC, no — it is one of the most commonly logged harmless warnings in Windows. It means a program was slow to let go of your settings when you signed out and Windows tidied up for it. On a multi-user server it is worth acting on, because repeatedly forcing a profile unload is how user profiles eventually become corrupt.
The event names it directly. Look for the 'Process NNNN (path)' line in the DETAIL section — that is the executable that still had registry keys open. The registry path underneath tells you which of its settings it was holding, which is usually enough to identify the feature responsible.
Only as a deliberate, temporary measure. The policy stops the forced unload, which removes the warning, but it also means the hive stays loaded until the offending process exits. On a busy session host that leaks memory and can leave profiles loaded indefinitely. Fixing or updating the process named in the event is the better outcome.
One occurrence will not. The risk is cumulative: each forced unload happens while something is potentially mid-write, and on a machine that signs users out dozens of times a day that eventually leaves a registry hive Windows will not load. The symptom when it happens is a temporary profile and Event 1511 at the next logon.
Last reviewed 6 September 2026