Knowledge Base for Windows

Description/Problem:
Everything worked fine for several weeks. After that we identify on Windows 2003 Terminal Server (Service Pack 2) strange issue related to Event ID 333 written to the system event log. This error indicate that operating system is not able to flush out or write to the registry hive.  The symptoms that accompany an Event ID 333 can vary between server hangs, “Insufficient resources exist to complete the requested service” errors, etc. In our case the solution was not so easy because all user profiles contain NTUSER.DAT file with size about 40 – 60 MB!

Solution:

• Took a backup of registry key and delete all the entries under it:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Hewlett-Packard

• Disable the PML Driver HPZ12 service,
• Took a backup of numerous entries under below registry keys and delete them:

  HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}
  HKEY_LOCAL_MACHINE\System\ControlSet003\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}

• Delete all the user profiles on the Terminal Server,
• Logon to the Terminal Server with valid user account,
• Check that NTUSER.DAT file size will be about 200 – 400 kB.

Some additional information related to this issue are published also in TechNet article: Troubleshooting Event ID 333 Errors.