Failed to access registry keys while the server is rebooting

[mharishkumarreddy]

Operating system: Windows 2003 server

Hello Gurus,

The Following is the issue that iam facing while accessing Windows Registry:

Description:
we use a service which sets values to a few keys in HKLM\SYSTEM\CurrentControlSet\Services\Test\Parameters\Control
during the start of application. When we reboot the system, the service deletes the values associated with those keys before it gets stopped. So that, when the server comes up after reboot, it will not read the old values.

The problem is, during the start of the application, all keys are getting created properly, but, during reboot, when the service
is trying to access the registry to reset the values, all the Registry API calls( RegOpenKey, RegCreateKeyEx etc..) are failing with windows error 19( ERROR_WRITE_PROTECT).

NOTE: The service has full Domain and Local administrator rights and full control over the registry.

Even a GetComputerName() API is returning 0 with GetLastError 19(ERROR_WRITE_PROTECT).

From the event logs, we observed that there are a few entries logged having Event ID: 1517 which means:

"Windows saved user MGMT-XHA\svcbhaslm registry while an application or service was still using the registry during log off.
The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use."
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account."

Later we installed UPHClean on the server and did a reboot and found the server frozen while rebooting. We did a hard reset to restart the server.

UPHClean logged the following entry into the event viewer:

The following handles in user profile hive MGMT-XHA\svcbhaslm (S-1-5-21-3690111373-1527127378-4234617882-1903) have been closed because
they were preventing the profile from unloading successfully:
lsass.exe (860)

HKCU\Software\Microsoft\SystemCertificates\Root (0x914)

call stack data collection not enabled for this process
HKCU\Software\Microsoft\SystemCertificates\CA (0x920)

call stack data collection not enabled for this process
HKCU (0x924)

call stack data collection not enabled for this process
HKCU\Software\Microsoft\SystemCertificates\Disallowed (0x930)

call stack data collection not enabled for this process
HKCU (0x934)

call stack data collection not enabled for this process
HKCU\Software\Policies\Microsoft\SystemCertificates (0x958)

call stack data collection not enabled for this process
HKCU\Software\Microsoft\SystemCertificates\trust (0x980)

call stack data collection not enabled for this process
HKCU (0x984)

call stack data collection not enabled for this process
HKCU\Software\Microsoft\SystemCertificates\My (0x990)

call stack data collection not enabled for this process
HKCU\Software\Policies\Microsoft\SystemCertificates (0x9cc)

call stack data collection not enabled for this process
HKCU\Software\Policies\Microsoft\SystemCertificates (0x9f8)

call stack data collection not enabled for this process.

Can any one help us in identifying the reason / solution for failure of these registry API's?

Thanks in advance,
Harish Reddy

[ahmd]

Hey, mharishkumarreddy, I know it's an old thread. I'm curious if you were able to resolve this issue?

[Igor Vartanov]

What I can see in the OP is that there are two issues, supposedly separate ones. The first one is registry write protection. That I find quite natural taking into consideration the fact of writing to system hive when system shutdown already initiated. I have not much info regarding Windows shutdown internal logic, but I would avoid writing to system hive just because I'm a cool service app.

The second one is inability to unload user profile due to locked profile files. This seems like follows: service gets blocked somehow on being unable to do the above action with system registry while having some other profile-specific keys, HKEY_CLASSES_ROOT or HKEY_CURRENT_USER, open. The system appears unable to unload the profile hive, about what failure it ultimately complains.

Which one is yours?

[ahmd]

Thanks, Igor. In my case I need this for the HKLM software hive for Windows XP family OS. Luckily in Vista they came up with the SERVICE_CONTROL_PRESHUTDOWN notification for the shut-down case, but in XP we're left to do all the service state saving "on the go" for as long as the system didn't terminate us...

From all my experience with the shut-down problems in XP, I can tell that the only reliable way for a service to save its state is to write it into its own file. I wish I knew this from the get-go, or if the registry APIs documentation stated it somewhere, I'd then stop using the system registry and create my own version of it in a p-list type file, or in an INI file, like it used to be in the old days. Now I'm too far gone using the registry and it becomes too confusing if I start using something else only for the shut-down...

[Igor Vartanov]

The only way I can imagine for service is to find (and specify) real dependencies on system services to make the system shut your service down prior to shutting the dependencies. Though I wouldn't have too much expectations about this.