| Event Id | 1511 |
| Source | UPHClean |
| Description | User profile hive RCARONDOM\u1 (S-1-5-21-3230802392-3390281410-1560515013-1307) is loaded even though user is not logged on. |
| Event Information | "According To Ondemandaccess" If you are using the reporting only mode you will get event id 1511 whenever UPHClean detects a hive loaded for an extended period of time if the user is not logged on (whether there are handles to it or not). This is important because it is possible that terminal server could run out of kernel mode resource (paged pool memory) when that happens. This could lead to users being prevented from logging on. |
| Reference Links | More Information |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.