User Profile Service Error 1512: Access Denied During Startup or Shutdown

Question

User Profile Service Error 1512: Access Denied During Startup or Shutdown

MovelessMove-0585 210

Hello, I am using Windows 11 25h2.

Version: 26200.0837

Feature: Home

When shutting down or turning on the computer, the following error is logged to eventvwr.msc:

Windows cannot remove your registry file. The memory used by the registry could not be freed. This problem usually occurs because of services running with a user account. Try configuring the services to run with the LocalService or NetworkService account.

DETAILS - Access denied.

The eventvwr.msc log shown above appears twice, reflecting this event when the computer is shut down or started up.

The following steps were followed during installation:

• The official Windows 11 download page was used.

• Windows Media Tools was used.

• Once the OOBE screen was reached, CMD was opened by pressing Ctrl + F10 and the following command was entered:

C:\Windows\System32> start ms-cxh:localonly

• After completing the setup with the local account, I made the necessary settings. The settings are as follows:

| Fast Startup and hypersleep were disabled.

| Signed in with Microsoft Account.

• However, even after these steps, this error continued to appear. As a solution, I did the following:

C:\Windows\System32> net user UserName /add

| Then,

C:\Windows\System32> net localgroup Administrators UserName /add

After these settings, I logged into the account and definitively deleted everything related to the old account from the Settings menu, and no old data remained.

After logging in as the new user, I logged back in with the Microsoft Account.

However, I observed that this error persisted in eventvwr.msc.

The following commands were run for system integrity:

C:\Windows\System23> Dism /Online /Cleanup-Image /Checkhealth

C:\Windows\System23> Dism /Online /Cleanup-Image /ScanHealth

C:\Windows\System23> Sfc /Scannow

• All of these commands confirmed that there were no problems.

• For a more in-depth diagnosis, the following commands were run:

Get-content -path "C:\Windows\Logs\CBS\CBS.log" -Tail 150

Get-content -path "C:\Windows\Logs\DISM\DISM.log" -Tail 150

Logs from both PowerShell instances were reviewed, and no system integrity issues were observed.

The error I mentioned above has been present since installation.

It is located in Eventwvr.msc at:

• Windows Logs -> Application

Based on what I've done, could you please provide information on why this error might have occurred on the system and what steps should be taken to resolve it?

0 comments

1 answer

Your answer

Answer 1

Brian Huynh 2,965 Microsoft External Staff Moderator

Hello MovelessMove-0585, Event ID 1512 occurs when an application or background service fails to release its lock on your user registry hive (NTUSER.DAT) during sign-out or shutdown. Because the file is locked, Windows cannot cleanly unload your profile. This is caused by third-party services—such as antivirus/cloud sync tools—running under your personal user account rather than as a system service.

Here are my suggested solutions:

1. Change Service Log On Accounts

Press Win + R, type services.msc, and press Enter.
Locate any third-party services running under your personal user account.
Right-click the service > Properties > Log On tab.
Change the account to Local Service or Network Service, apply the changes, and restart your computer.

2. Disable Fast Startup

Open Control Panel > Hardware and Sound > Power Options.
Click Choose what the power buttons do.
Click Change settings that are currently unavailable.
Uncheck Turn on fast startup, then Save changes.

3. Perform a Clean Boot

Press Win + R, type msconfig, and press Enter.
Go to the Services tab, check Hide all Microsoft services, and click Disable all.
Restart your computer. If the error is resolved, you can re-enable services one by one to identify the specific software causing the conflict.

I am happy to follow up with you until we get this fixed, so please reply and let me know how it goes.

If this solution resolves your problem, please click "Accept answer." Doing so helps other community members find this fix quickly.

MovelessMove-0585 210 Reputation points

2026-03-13T07:20:05.1633333+00:00

Hello,

• I checked with Services.msc and couldn't find any running services associated with my account.

• Also, Fast Boot was always disabled for me.

• I restarted using MSConfig, selecting "Hide all Microsoft services," but the situation didn't change; the error I mentioned reappeared in eventvwr.msc.

• Furthermore, if I were to elaborate a bit more on the eventvwr.msc log, it would look like this:

System

- Provider

[Name] Microsoft-Windows-User Profiles Service

[Guid] {89b1e9f0-5aff-44a6-9b44-0a07a7ce5845}

EventID 1512

Version 0

Level 2

Task 0

Opcode 0

Keywords 0x80000000000000000

- TimeCreated

[SystemTime] 2026-03-13T07:02:01.4875554Z

EventRecordID 2331

Correlation

- Execution

[ProcessID] 1924

[ThreadID] 824

Channel Application

Computer (I intentionally left this section blank)

-Security

[UserID] S-1-5-18

Furthermore, the only services I didn't disable in MSConfig that I considered critical were:

• NVIDIA LocalSystem Container

• NVIDIA DISPLAY Container LS

Apart from these services, I disabled all other non-Microsoft services in MSConfig, restarted as mentioned above, and tested again, but the problem persisted.
Brian Huynh 2,965 Reputation points Microsoft External Staff Moderator

2026-03-13T08:11:42.2333333+00:00
Thank you for the detailed logs and systematically testing those steps.

Since we have ruled out standard third-party services, the lock on your user registry hive is likely being held by a background application (which msconfig does not control).

Please proceed with these next steps:

1. Temporarily Disable the NVIDIA Services Windows will still display fine using default drivers for a quick test. Disable those services in msconfig, restart, and check Event Viewer.

2. Disable Task Manager Startup Applications

Right-click your Taskbar and open Task Manager.

Go to the Startup tab.

Right-click and Disable all items listed there, then restart and test.

3. Verify User Profile Group Policy

Press Win + R, type gpedit.msc, and press Enter.

Navigate to: Computer Configuration > Administrative Templates > System > User Profiles.

Double-click on Do not forcefully unload the user registry at user logoff.

Ensure this is set to Not Configured or Disabled, then click OK.

4. Check scheduled tasks that run as your user

Open Task Scheduler > Task Scheduler Library.

Look for any tasks (under Microsoft\Windows) whose “When running the task, use the following user account” field is set to your user.

If they don’t need your profile loaded, change them to run as a built-in service account or configure “Run whether user is logged on or not” with a service account.

I will be right here waiting for your results, so let me know how it goes.
MovelessMove-0585 210 Reputation points

2026-03-13T09:33:07.46+00:00

Hello,

• I did what you suggested in step 1 and restarted, but the situation didn't change and the same error still appears.

• In Task Manager startup settings, all applications are set not to start automatically.

• What you suggested in step 3 doesn't work because, as I mentioned above, I'm using Windows 11 Home.

• As for what you suggested in step 4, I did a general check with taskschd.msc, but I couldn't find anything specifically related to my user account causing this error. All I did was:

Task Scheduler > Task Scheduler Library > Microsoft\Windows\ApplicationData

In that section, I changed the permissions of the following task (Permission to be duty: appuriverifierdaily):

from INTERACTIVE to SYSTEM.

However, as far as I can see, the access restriction issue in the Event Viewer is still not resolved.

Is this error I'm experiencing a bug related to Windows 11? Or could it be something misconfigured?
Brian Huynh 2,965 Reputation points Microsoft External Staff Moderator

2026-03-16T02:56:48.6966667+00:00
Hello again!

Event ID 1512 is rarely a Windows 11 bug. Instead, it is usually a lingering OS handle or mild profile corruption. If you are not experiencing actual issues, this error is often harmless.

Since you are on Windows 11 Home and cannot use Group Policy, please try these next steps:

Press Win + R, type regedit, and press Enter.

Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System (If the 'System' folder doesn't exist under Windows, right-click 'Windows' > New > Key, and name it System).

Right-click in the right pane > New > DWORD (32-bit) Value.

Name it DisableForceUnload.

Double-click it, ensure the Value data is set to 0, and click OK. Restart your PC.

I am eager to hear your results, so please keep me posted.
MovelessMove-0585 210 Reputation points

2026-03-16T19:36:17.0933333+00:00
Thank you for your reply.

Before trying the method you suggested, I performed a Repair Installation via Windows Update, meaning I installed the Repair Version. After that, the existing user profile error persisted (the profile error I mentioned above).

After running the command you suggested as CMD (Administrator), I entered the following command:

C:\Windows\System32> reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableForceUnload /t REG_DWORD /d 0 /f

Then I restarted the computer.

I checked the Event Viewer and saw multiple 10010 DCOM errors (in the Windows Logs -> System section). Thinking these errors were temporary, I restarted the computer again and checked eventvwr.msc again; the profile error I mentioned above was still present in the application section (despite the key you provided). However, the 10010 DCOM error was gone. (in the Windows Logs -> System section)

So I entered the following command:

C:\Windows\System32> reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableForceUnload /f

And I restarted the computer, but I noticed that this profile access error could not be fixed.

Do you think a fix patch will be released? Because it seems that this situation cannot be fixed in the normal way.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Brian Huynh 2,965 Reputation points Microsoft External Staff Moderator

2026-03-23T00:50:49.9966667+00:00

To answer your question directly: It is very unlikely Microsoft will release a specific "fix patch" for this. Since your Repair Installation did not resolve it, this confirms it is not a corrupted file or a broken installation, but rather a known "race condition" in Windows 11.

During sign-out or shutdown, native Windows components (like Windows Defender, Windows Search, or background AppX processes) sometimes hold onto your NTUSER.DAT registry file for a fraction of a second too long. Windows logs the 1512 "Access Denied" error because it expects an immediate release. However, the system's User Profile Service safely force-closes the handle shortly after, meaning no actual harm is done.

Since you have confirmed this is isolated to the event log and you are not experiencing actual functional issues (such as being forced into a "Temporary Profile" upon reboot), my recommendation is to safely ignore this event log.

Event Viewer is notoriously filled with benign warnings and errors that are completely normal for a healthy Windows environment. Windows is designed to recover from these minor handle locks automatically. Unless it starts impacting your daily usage, chasing this "ghost" error further is unnecessary for your system's health.
MovelessMove-0585 210 Reputation points

2026-03-27T05:35:57.3+00:00

Hello, I have a few questions I'd like to ask you:

• Why are there these seemingly harmless error logs that appear in the Event Viewer? And why are there many errors like this sometimes?

• If there's no solution to these errors, why do they occur and why isn't a complete patch released? What usually triggers them?

I would be very grateful if you could answer these questions.

Share via

User Profile Service Error 1512: Access Denied During Startup or Shutdown

1 answer

Your answer