| Event Id | 1501 |
| Source | UPHClean |
| Description | The following handles opened in user profile hive RCARONDOM\u1 (S-1-5-21-3230802392-3390281410-1560515013-1307) are preventing profiles from unloading: profleak.exe (1364) HKCU\SOFTWARE\Policies (0xb4) HKCU (0xb8) |
| Event Information | "According To Ondemandaccess" If you are using the reporting only mode (see above on how to set) you will get event id 1501 whenever UPHClean detects a user logging off and the profile being held: |
| Reference Links | More Information |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.