The “Modified time” file attribute of a registry hive file is updated when you load and then unload the registry hive files without making any changes to the files on a computer that is running Windows Server 2008 or Windows Vista
Consider the following scenario:
- You have an application on a computer that is running Windows Server 2008 or Windows Vista.
- The application calls the RegLoadKey function to load a registry hive file.
- This application calls the RegUnLoadKey function to unload the registry hive file without making any changes.
In this scenario, the Accessed time file attribute and the Modified time file attribute of the file are updated. However, the expected behavior is that only the Accessed time file attribute is updated.
This scenario may cause an issue in the following environment:
- You configure the Delete user profiles older than a specified number of days on system restart Group Policy to remove the user profiles that are not accessed for some time.
Note: To find the Delete user profiles older than a specified number of days on system restart Group Policy, do the following. Under Computer Configuration, expand Administrative Templates, expand System, and then click User Profiles.
- You set up some antivirus applications or some anti-malware applications to run on the servers. These applications regularly scan user profiles for security.
In this environment, every time that the antivirus applications or the anti-malware applications scan the user profile registry hive files, the files are updated. Therefore, the configured Delete user profiles older than a specified number of days on system restart Group Policy becomes ineffective.
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB973148.