0

My Java app runs as a Windows service under "Local System" user and uses the Windows registry. I've noticed that after a Windows update and a machine restart my keys which are stored under HKEY_USERS\S-1-5-18\Software\JavaSoft\Prefs\ were deleted. here are some logs from the Windows event log:

The access history in hive \Device\HarddiskVolume1\Boot\BCD was cleared updating 24 keys and creating 5 modified pages.
The access history in hive \SystemRoot\System32\Config\SOFTWARE was cleared updating 30655 keys and creating 6722 modified pages.
The access history in hive \SystemRoot\System32\Config\SAM was cleared updating 71 keys and creating 7 modified pages.
The access history in hive \SystemRoot\System32\Config\DEFAULT was cleared updating 185 keys and creating 26 modified pages.
The access history in hive \SystemRoot\System32\Config\SECURITY was cleared updating 72 keys and creating 5 modified pages.

This was observed in OS Windows 2012 and Windows 2016 with different KBs.
Did anyone else face the same issue? Can anyone explain why does the registry is being cleared?
Will it help if I will use a different path in the registry, such as "HKEY_LOCAL_MACHINE"? Any suggestions for how to avoid this scenario?

1 Answer 1

2

This is a normal registry cleanup that is done periodically by Windows every few days, or after Windows crashes.

The event is Event ID: 16.

Windows Update does a very aggressive registry cleanup after each major update. It is quite normal for some applications to require re-installation after some such update.

In my case, I have two applications that need to be reinstalled after each major update. It is always the same two applications, with no explanation why these two apps are so disliked by Windows.

If your app suffers also from this problem, try to change the location in the registry in which your data is stored, or move it into a file, to protect it from Windows.

2
  • I wonder if this has to do with the fact that the user is "Local System"? Will it help if I will use a different path in the registry, such as "HKEY_LOCAL_MACHINE"?
    – Meron
    May 12, 2021 at 7:00
  • 1
    It might help to move the registry key or change the user account, but I never managed to understand why Windows hates these two products, which are btw also system services. I don't control these two products, but as you do control yours and can experiment, it would be interesting for you to share your conclusions here if you find anything.
    – harrymc
    May 12, 2021 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.