Cheers Guys, I checked the link below out and we have the Sophos fix installed as of the 19th. Sophos also recommended to add the regdll.exe to the authorised apps list which I did this morning, I then checked the citrix servers and about half of them were perfomring normally, but it actually looks like they were before I added the authorised app. Weve actually been getting around it anyway by running a VB script which unloads the user profile hives from hkey_user before the registry gets full The other half are still not unloading the profiles from the registry. Just for addition, these servers also get a event ID 333 - An I/O operation initiated by the Registry failed unrecoverably Im gonna give those failing citrix servers a reboot tonight to see the effect, but I still cant get confirmation as to whether its definetely a sophos issue. There must be someone else out there whose going through the same thing? ________________________________ From: Webster <webster@xxxxxxxxxxxxxxx> To: thin@xxxxxxxxxxxxx Sent: Tue, 21 December, 2010 21:41:05 Subject: [THIN] Re: User profile hives from registry not unloading - possible issue with sophos Probably not related but have you seen this: http://support.microsoft.com/kb/2486249/en-us?sd=rss&spid=12925 Webster From:thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of andy mac Subject: [THIN] User profile hives from registry not unloading - possible issue with sophos Is anyone using sophos on their Citrix servers and started experiencing User profile hives not unloading from the registry? its started happening for us a couple of weeks ago, but just hit us hard over the last couple of days as the registry on a few of our Citrix servers filled up, leaving the servers unresponsive to new logons Sophos is reporting dodgy activity in m:\windows\ps400hotfix\regdll.exe, so ive passed this onto sophos for false positive analysis, but the only citrix servers that arent showing this behaviour are 2 that are still needing a reboot after a sophos update that was pushed out to all the Citrix servers on 6th December. All the other Citrix servers have been rebooted since then.