System.Runtime.InteropServices.COMException (0x800703FA): Illegal operation attempted on a registry key that has been marked for deletion


  • Problem Description     
    You have a COM+ server application. The application is set to run as a particular user. After working for sometime on Windows Server 2008 the application may stop working and keep failing. Unless you restart the COM+ application, it won’t come back. In the meantime you may see an error like this in the application event log on the CLIENT machine:

    Event Type:        Error     
    Event Source:    DCOM      
    Event Category:                None      
    Event ID:              10006      
    Date:                     10/17/2009      
    Time:                    1:36:39 PM      
    User:                     Domain\user      
    Computer:          *****      
    DCOM got error "Unspecified error " from the computer ‘servername’ when attempting to activate the server: {EF047BF9-F91A-4D5B-A18F-BED49553703B}

    In this case the event message tells you that the error (E_FAIL or 80004005 or Unspecified error ) is returned from the server during activation vs. a method call. The component CLSID is {EF047BF9-F91A-4D5B-A18F-BED49553703B}

    The identity user initially logged on to the server when the application launched. The issue happens when the identity user logs off and the COM+ application can no longer read registry keys in the profile of the identity user because of a new User Profile Service functionality of forcing the unload of the user profile on Windows 2008 when the user logs off. Note this new User Profile Service functionality is built into the OS by default.This is a situation where the functionality of forcing the unload of the user profile may break an application if registry handles are not closed in the process.

    If you enable COM tracing, you’ll see the error ERROR_KEY_DELETED in the ole32 trace log:

    [2] 0BA8.15D0::10/17/2009-13:07:54.390 [OLECOM](:CComRegCatalog::GetClassInfoW) CLSID:ecabafae-7f19-11d2-978e-0000f8757e2a 1018(ERROR_KEY_DELETED)      
    [2] 0BA8.15D0::10/17/2009-13:07:54.390 [OLECOM](:CComCatalog::GetClassInfoInternal) CLSID:ecabafae-7f19-11d2-978e-0000f8757e2a Flags:0 IID:00000000-0000-0000-c000-000000000046 0x800703fa(ERROR_KEY_DELETED)

    You'll see events like this in the application event log:

    Log Name:      Application     
    Source:        Microsoft-Windows-User Profiles Service      
    Date:          10/26/2009 8:22:13 AM      
    Event ID:      1530      
    Task Category: None      
    Level:         Warning      
    Keywords:      Classic      
    User:          SYSTEM      
    Computer:      DAVIDQIU2008      
    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. 

    DETAIL -     
    1 user registry handles leaked from \Registry\User\S-1-5-21-1049297961-3057247634-349289542-1004_Classes:      
    Process 2428 (\Device\HarddiskVolume1\Windows\System32\dllhost.exe) has opened key \REGISTRY\USER\S-1-5-21-1049297961-3057247634-349289542-1004_CLASSES

    As a workaround it may be necessary to disable this feature which is the default behavior. The policy setting 'Do not forcefully unload the user registry at user logoff' counters the default behavior of Windows 2008. When enabled, Windows 2008 does not forcefully unload the registry and waits until no other processes are using the user registry before it unloads it.

    The policy can be found in the group policy editor (gpedit.msc)   
    Computer Configuration->Administrative Templates->System-> UserProfiles    
    Do not forcefully unload the user registry at user logoff

    Change the setting from “Not Configured” to “Enabled”, which disables the new User Profile Service feature.

    'DisableForceUnload' is the value added to the registry

    Tuesday, May 07, 2013 3:29 PM