Events 6287, 45569, 3280, 3263, 6979, 7082 - Illegal operation attempted on a registry key that has been marked for deletion. (0x800703fa)

Problem

This error can occur in multiple scenario's with Enterprise Vault (EV) Core product and EV Compliance Accelerator product.
Illegal operation attempted on a registry key that has been marked for deletion.  (0x800703fa)

1. Journal task fails after a series of events such as Event 45569, Event 3280, Event 3263 relating to 'KVS.Accelerator.PlugIn.Filter'.
2. Retrieval of archived items fails with events such as Event 6287, Event 6979.
3. Clear backup mode operation fails with Event 7082.

Error Message

Scenario 1. Journal Task Failure.

Event ID: 45569
Description: An error has occurred in the deduplication cache.
Error: Illegal operation attempted on a registry key that has been marked for deletion. (0x800703fa)
Internal References: Error 0x800703fa
CDeDuplicationCache::IsADuplicateMsg .\DeDuplicationCacheImpl.cpp [lines {276,281}], built Mar 14 10:54:46 2011
V-437-45569 

Event ID: 3280
Description: Could not filter a message for Accelerator random message sampling.
Error: Illegal operation attempted on a registry key that has been marked for deletion. (0x800703fa)
Internal References: Error 0x800703fa
CFilter::MsgIsDuplicate .\Filter.cpp [lines {826,853}], built Mar 14 10:54:47 2011
V-437-3280

Event ID: 3263
Description: An error occurred processing the external filter 'KVS.Accelerator.PlugIn.Filter'. No more filters will be processed.
Error: Illegal operation attempted on a registry key that has been marked for deletion. (0x800703fa)
Mailbox: /O=Test/OU=Sales/CN=RECIPIENTS/CN=JOURNAL-MBX-1
Message Folder: ?Inbox
Message Title: RE: Test Build Today
V-437-3263

Scenario 2. Retrieval of archived items failure.

Event ID: 6287
Task Category: Web Application (WP)
Level: Warning
Description: Unable to fetch item from "evserver01".
Reason: Illegal operation attempted on a registry key that has been marked for deletion.  [0x800703fa]
Saveset Id: 201003010000000~201001291349270000~Z~70CE6F1E10CE82DFA2FAE0209D99EAB1
Archive Name: XYZ
Archive Folder Path: ABC
Reference: [GOAFS]
V-437-6287 

Event ID: 6979
Task Category: Web Application (WP)
Level: Error
Description: AutoStorageOnline error.
Reason: Illegal operation attempted on a registry key that has been marked for deletion.  [0x800703fa]
Reference: [CO]
V-437-6979 

Event ID: 6979
Task Category: Web Application (WP)
Level: Error
Description: AutoStorageOnline error.
Reason: Illegal operation attempted on a registry key that has been marked for deletion.  [0x800703fa]
Reference: [CTSOL]

When trying to open the archived item, users get prompted for user name and password. The complete item doesn't open up, giving the banner "The archived item is currently unavailable.." When clicking on the banner, we get following error: An internal error occurred on the web server server Error -2147024732
Client Trace show the following error = CShortcutItem::Display...Return Last Failed error: 0x80004005

Scenario 3. Clear backup mode operation fails.

Event ID: 7083
Description: Unable to clear Vault Store Backup Mode.
Reason: Illegal operation attempted on a registry key that has been marked for deletion.  [0x800703fa]
VaultStoreGroupEntryId: 1A91FE0971DC2884DA4C9E83CBE11AA111013300PHSEV01
Name: VSG1
V-437-7083

Cause

The User profile is unloaded once the Vault Service account is logged off. This is a new feature in Windows 2008 and the Uphclean process. The intent is that when a user logs on to a server and the application is launched, there is no issue. But when the user logs off, the user profile is unloaded. As in this case, it appears that forcing an unload of the user profile breaks the deduplicationcache as this application no longer can query the HKCU registry.

This error can also occur if registry replication has failed in a clustered environment. Simply failing over to the passive node is not sufficient to allow replication to occur.

Solution

This issue can be resolved by modifying the Group Policy settings applied to affected user (Vault Service Account).

1. Open the group policy editor (gpedit.msc)
2. Go to Computer Configuration->Administrative Templates->System-> UserProfiles-> Do not forcefully unload the user registry at user logoff.
3. Change the setting from “Not Configured” to “Enabled”, which disables the new User Profile Service feature.

In the case of a clustered EV server, a restart of the active cluster node is required for registry replication to occur:
1. Fail the cluster to the passive node.
2. Restart the original primary node.
3. Fail the cluster back to the original node.

Note: There is a work around available for Scenario 1 (Compliance Accelerator, Journal Task failure)

Please contact Veritas Support Services to get the workaround. This workaround can only be used to ignore the dedupe cache check if the solution given above does not help to resolve the issue.

Applies To

Windows 2008 x64 Server.