A few notes for those who haven't used oh.exe before (as I hadn't before getting this problem). First install oh.exe on the server from the Windows 2000 resource kit. If you don't want to install the whole resource kit on your server, install on a workstation and simply copy oh.exe from the workstation into the system32 directory on the server.

First, type "oh" at a command prompt to switch on diagnostic logging in the kernel. Reboot the server, you cannot use oh until you have done. Now, at any time on the server you can type "oh -t key user" to produce a list of open handles to the user portion of the registry. It can be a very long list so consider directing output to a text file e.g. "oh -t key user > oh.txt"

To find the application that is causing event 1000, get ready to run oh.exe on the console of the server and then get a problem user to log out. When the users gets the "Saving your settings..." message and it hangs there, run oh.exe on the console before they get logged out. This is easier said than done if it is an intermittent problem as you don't know if the use will get the problem of not.

Examine the output of oh.exe and look for any registry handles left open for the user in question. The oh.exe output refers to users by their internal ID rather than by name (eg. S-1-5-21-1231423735-1728518174-1221738049-1285). To work out which user is which, run regedit while logged in as the user in question, add a string value to HKCU with their name in it, then look in HKU and find the matching string value listed under one of the user keys. You will now be able to search on the internal reference of the user and find what process is causing the problem. This might help immediately, for example if "winvnc.exe" has the open key you know it is VNC causing the problem. If it is a system process such as csrss.exe, you'll have to dig further to find what is causing the problem, could be printer drivers etc.

If oh.exe takes too long to run (it can take a few minutes on a loaded terminal server), you won't be able to run it during the 1 minte that the user logout is hangin. Increase the amount of time you have by using gpedit on the server to alter the number of re-tries up from 60 to say 600. This will give you ten minutes, while they are hanging at the "Saving settings..." message, for you to run oh.exe.