3

Today, we have encountered the issue with the SharePoint 2010 search, have verified and found that it is an known issue with Windows server 2008(R2).

many articles says that we have to enable the policy setting 'Do not forcefully unload the user registry at user logoff' on the server where the search service is running on.

Is it fine to do so?

Note:
IIS reset have fixed the issue.

Reference articles:
http://social.technet.microsoft.com/Forums/en-US/sharepoint2010setup/thread/b464d58a-32ff-44d0-93dd-b7b240e96869
http://www.mysticslayer.com/?p=200
http://pacsharepoint.com/2011/11/sharepoint-search-illegal-operation.html
http://blogs.msdn.com/b/distributedservices/archive/2009/11/06/a-com-server-application-may-stop-working-on-windows-server-2008.aspx
http://support.microsoft.com/kb/947238

ULS Logs:

02/01/2012 09:06:52.84 w3wp.exe (0x1018) 0x1E28 SharePoint Server Search Query dka5 High
SearchServiceApplicationProxy::Execute--Error occured: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.Runtime.InteropServices.COMException: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at Microsoft.Office.Server.Search.Query.KeywordQueryInternal.Execute()
at Microsoft.Office.Server.Search.Query.QueryInternal.Execute(QueryProperties properties) at Microsoft.Office.Server.Search.Administration.SearchServiceApplication.Execute(QueryProperties properties) at SyncInvokeExecute(Object , Object[] , Object[] )
at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.Se...).
ad5d91ce-6900-4436-b994-6a2dc54c23ce

02/01/2012 09:06:52.84 w3wp.exe (0x1018) 0x1E28 SharePoint Server Search Query dlr1 High Exception when fetching results: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.Runtime.InteropServices.COMException: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at Microsoft.Office.Server.Search.Query.KeywordQueryInternal.Execute()
at Microsoft.Office.Server.Search.Query.QueryInternal.Execute(QueryProperties properties) at Microsoft.Office.Server.Search.Administration.SearchServiceApplication.Execute(QueryProperties properties) at SyncInvokeExecute(Object , Object[] , Object[] )
at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.Se...).
ad5d91ce-6900-4436-b994-6a2dc54c23ce

02/01/2012 09:06:52.85 w3wp.exe (0x1018) 0x1E28 SharePoint Server Search Query g1j9 Exception
Internal server error exception: System.ServiceModel.FaultException1[System.ServiceModel.ExceptionDetail]: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.Runtime.InteropServices.COMException: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at Microsoft.Office.Server.Search.Query.KeywordQueryInternal.Execute()
at Microsoft.Office.Server.Search.Query.QueryInternal.Execute(QueryProperties properties) at Microsoft.Office.Server.Search.Administration.SearchServiceApplication.Execute(QueryProperties properties) at SyncInvokeExecute(Object , Object[] , Object[] )
at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs) at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc) at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc) at System.Se...). System.ServiceModel.FaultException
1[System.ServiceModel.ExceptionDetail]: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.Runtime.InteropServices.COMException: Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at

02/01/2012 09:06:52.85 w3wp.exe (0x1018) 0x1E28 SharePoint Server General 7888 Warning
A runtime exception was detected. Details follow. Message: Thread was being aborted. Technical Details: System.Threading.ThreadAbortException: Thread was being aborted.
at System.Threading.Thread.AbortInternal() at System.Threading.Thread.Abort(Object stateInfo) at System.Web.HttpResponse.End() at System.Web.HttpServerUtility.Transfer(String path) at Microsoft.SharePoint.Utilities.SPUtility.TransferToErrorPage(String message, String linkText, String linkUrl) at Microsoft.Office.Server.Search.WebControls.QueryUIError.GetErrorMessageOrRedirectToErrorPage(Exception ex, Boolean showMessages) at Microsoft.Office.Server.Search.WebControls.CoreResultsDatasourceView.GetXmlResponseDoc(DataSourceSelectArguments selectArguments) at Microsoft.Office.Server.Search.WebControls.CoreResultsWebPart.GetXPathNavigator(String viewPath) ad5d91ce-6900-4436-b994-6a2dc54c23ce

Event viewer logs:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 4 user registry handles leaked from \Registry\User\S-1-5-21-1593251271-2640304127-1825641215-1112252_Classes: Process 8968 (\Device\HarddiskVolume1\Windows\System32\inetsrv\w3wp.exe) has opened key \REGISTRY\USER\S-1-5-21-1593251271-2640304127-1825641215-1112252_CLASSES Process 7156 (\Device\HarddiskVolume1\Windows\System32\inetsrv\w3wp.exe) has opened key \REGISTRY\USER\S-1-5-21-1593251271-2640304127-1825641215-1112252_CLASSES Process 8968 (\Device\HarddiskVolume1\Windows\System32\inetsrv\w3wp.exe) has opened key \REGISTRY\USER\S-1-5-21-1593251271-2640304127-1825641215-1112252_CLASSES Process 7156 (\Device\HarddiskVolume1\Windows\System32\inetsrv\w3wp.exe) has opened key \REGISTRY\USER\S-1-5-21-1593251271-2640304127-1825641215-1112252_CLASSES 0 1530 2012-01-31 10:45:00
Microsoft-Windows-User Profiles Service

1
  • none has clue? any suggestions... Feb 5, 2012 at 12:37

1 Answer 1

1

I have had this issue before and setting that policy setting never solved our problem. We were able to configure the search, add sources, crawl, define managed properties,... but firing queries gave us the exact error as mentioned above.

We only solved it the drastic way. Remove the search application and reconfigure it from scratch. I reckon, in our case, some bad permissions / settings were to blame.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.