We have a customer with a Sharp printer (and Sharp drivers) and this article is exactly what we needed to point us in the right direction.

Without this info we would still be searching.
Thnx Carl and all others for posting you’re solutions.

However, we also saw that one of the servers also had the HP registry key (thousands upon thousands of them!) stored in the shadow keys, so each user was picking these up and storing them in their profile as well. We were seeing NTUSER.DAT bloat for each user logging in. However due to how the registry works, even removing the offending keys from the registry for the users isn’t sufficient to recover that space, their NTUSER.DAT still stays at a large size (in our case, betwee 35 and 50MB). When you have 80 users logging into one server and take into consideration the previously bloated DEFAULT and HKLM hives, this soon maxed the registrysizelimit and stopped logons working.

I’ve deleted the HP keys from \.DEFAULT\SOFTWARE\Hewlett-Packard and \HKLM\SOFTWARE\Hewlett-Packard, as well as the shadow keys which in my case I found on both 32bit and 64bit locations. I then removed the HPs entirely from the servers as we use a Canon print solution where all devices are now Canon (or have difference files written for them by Canon), or we use Citrix UPD.

So far, things are remaining OK. I haven’t attempted the refresh of the HIVES for SOFTWARE and DEFAULT yet, as the system these servers host is going cloud in the next 12 months, and I unfortunately don’t have time to investigate it much further.

One last note: When I rebooted after running the registry compressor nothing could communicate with the server. The server seemed fine but I couldn’t RDP and the farm wasn’t connecting to either of my servers. I was panicked thinking I hosed both of my servers and was going to have to do a restore. After another reboot they came up fine and I haven’t had an issue since then. Maybe this will happen to you. Just ask yourself the question you always ask your users:

Have you tried rebooting? LOL

http://www.tliquest.net/software/rsp/

Had extremely good luck with the tweaking.com registry compressor. It took about 20 mins to go through a 1.5 GB registry file on Best compression. Almost no time at all to move and compress the file.

In my particular case these were the large folders:
HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
HKEY_USERS\.DEFAULT\Software\Sharp\CSR|mhsdc1

Hi Martin/All

Please note that we used the 3rd party tool mentioned from Tweaking.com and it worked great completely compressing the file. However the next day we noticed 100% CPU on every server we ran the tool on. On further investigation, the winlogon.exe process was using about 3-5% CPU for each user logged onto the server. We found that the winlogon.exe process was ‘looping’ since it was missing some critical reg keys in the HKEY_USERS\.DEFAULT hive. The tool pretty much deletes everything even required critical keys! We ended up having to go and use the official Microsoft method to resolve the issue. Or, goto a working server and export the reg to a file, and import it after running the 3rd party tool. CPU dropped from 100% to 0 instantly after importing the reg keys.

Boot one working machine into recovery console and copy the file c:\windows\system32\config\default to the root of the hard disk. Reboot normally
Copy the default file from the working machine to the failing machine to the root of the hard disk
Boot the failing machine using recovery console and copy the file c:\windows\system32\config\default to c:\windows\system32\config\default.old to have a backup.
Copy the file c:\default to c:\windows\system32\config\default
Reboot the machine

I was able to find these using the RU utility. Here is the process I used to clean up the registry:

1. Open Regedit
a. Delete the following Keys:
○ HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
○ HKEY_USERS\.DEFAULT\Software\SSPrint\spep6
b. Add the following Keys:
○ HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
○ HKEY_USERS\.DEFAULT\Software\SSPrint\spep6
2. Reboot
3. Open regedit
4. Browse to   HKEY_USERS\.DEFAULT
5. Right click on .DEFAULT Select Export
6. Export the .DEFAULT hive as a “Registry Hive” file with a unique name.  %windir%\system32\config\compressedDEFAULT
7. You can use Windows Explorer verify the old and new sizes of the registry hives. (DEFAULT = ~600 MB, compressedDefault = ~3MB)
8. Shutdown Server
9. Start the server by using Windows Server 2008 R2 SP1 media.
10. Select Repair your computer.
11. Select Command Prompt.
12. At the command prompt, run the following commands to Rename the hives so that you will boot with the compressed hive.
a. %windir%\system32\config\ren DEFAULT DEFAULT.old
b. %windir%\system32\config\ren compressedDEFAULT DEFAULT
13. Reboot Server
14. Open Regedit verify the following Keys are empty
• HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
• HKEY_USERS\.DEFAULT\Software\SSPrint\spep6

Installed hotfix http://support.microsoft.com/kb/2871131

Looks to be a problem with print driver. Hopefully these tools and steps will fix problem!

What am I doing wrong?.

Thanks for putting the time into writing it.

i’m experiencing the same issue on a 2008R2 RD broker FARM. I’ve installed the HOTFIX and compressed the HIVE successfully on the 1st Terminal Server. The other 2 servers didn’t behave as expected. The other 2 servers blue screened after hive compression. I had to revert the machines to a earlier snapshot (cloned/sysprepped from the 1 server) servers. After the installation of the HOTFIX i’ve noticed that the HIVE still is filling up with entries of the Dymo Labelwriter driver… Does anyone else experienced a same issue on a xenapp or terminal server farm? I think that the only woraround possible is eliminate the bad printer and driver (not Xenapp/terminal server aware drivers), use VDISKS and/or create some kind of script who cleanes up the bloated registry hive.

Regards… Naures

Here´s a link to registry compressor
http://www.tweaking.com/content/page/tweaking_com_registry_compressor.html

/Martin

I am experiencing the same issue with TEMP profiles in a Xenapp 6 environment.

The .DEFAULT key is 1.96GB in size.

http://social.technet.microsoft.com/Forums/windowsserver/en-US/971a6470-7e5c-4bd6-85bb-82228aa7c55c/rds-insufficient-system-resources-exist-to-complete-the-requested-service-for-users-ntuserdat

This is the process I took to compress the hive, and it went from 1.5GB to less than 10MB! Hope this helps.

Agreed on the ‘great article’ note.

Quite happy to, via your response, find the Ru utility. DUREG.exe was recommended by our Microsoft support (from the windows 2000 resource kit…) and it failed on half of my test runs.

Shane: I would love to hear about another process to delete keys and re-compress a registry hive. Hope you add to your post.

Aaron, after your initial comment I asked the senior(!) support engineer the exact question… and he gave the wrong answer…

It’s a worry when Microsoft don’t get it right, but it’s a common misconception. Citrix don’t get it right either.

It works great, did it on a bunch of XA Server’s where I had the same print driver bloat issues…

Thanks,

Shane

Interesting that it was a Ricoh-printer driver, must say….