System.UnauthorizedAccessException: Access to the registry key ‘Global’ is denied


Your AppFabroc client application may throw the following exception after you install a cumulative update package (CU) for AppFabric 1.1:

System.UnauthorizedAccessException: Access to the registry key ‘Global’ is denied.
   at Microsoft.Win32.RegistryKey.Win32Error(Int32 errorCode, String str)
   at Microsoft.Win32.RegistryKey.InternalGetValue(String name, Object defaultValue, Boolean doNotExpand, Boolean checkSecurity)
   at Microsoft.Win32.RegistryKey.GetValue(String name)
   at System.Diagnostics.PerformanceMonitor.GetData(String item)
   at System.Diagnostics.PerformanceCounterLib.GetPerformanceData(String item)
   at System.Diagnostics.PerformanceCounterLib.get_CategoryTable()
   at System.Diagnostics.PerformanceCounterLib.CategoryExists(String machine, String category)
   at System.Diagnostics.PerformanceCounterCategory.Exists(String categoryName, String machineName)
   at Microsoft.ApplicationServer.Caching.ClientPerformanceCounters.InitializeClientPerformanceCounters()
   at Microsoft.ApplicationServer.Caching.ClientPerformanceCounters.IsPerfCountersEnabled()
   at Microsoft.ApplicationServer.Caching.DataCacheFactory..ctor(DataCacheFactoryConfiguration configuration)

It is a registry permission issue. The check for performance monitor counters (ClientPerformanceCounters.IsPerfCountersEnabled) was first introduced in the CU1 release. You won’t see the issue in AppFabric 1.0 and 1.1 RTM.

Workaround:

  • Add the cache client application account to the following groups: Performance Monitor Users group and Performance Log Users group, and
  • Restart the cache client application

As of today, these are the AppFabric 1.1 cache client versions Microsoft has released:

RTM: 1.0.4632 (29-Nov-2011)
CU1: 1.0.4639 (20-Feb-2012)
CU2: 1.0.4644 (29-May-12)
CU3: 1.0.4652.2 (27-Nov-2012)
CU4: 1.0.4653.2 (28-Mar-2013)

CU=cumulative update


Comments (6)

  1. 0v3rCl0ck says:

    Just a tip:

    If you're using appfabric caching from an application hosted on IIS, remember to reboot / restart the server after you changed the security, otherwise you will still receive the error.

    Also remember that if you're using ApplicationPoolIdentity as identity of the IIS pool, you will need to add to those groups the user as follow: "IIS APPPOOLname_of_the_pool"

    I'm on Windows Server 2012 R2

  2. davidqiu says:

    You do not need to reboot the server. You need to reset IIS or restart the app pools.

  3. Ken says:

    Hi Michael,

    Thanks for the post. What should we do if our client app (Azure Website) and the AppFabric VM are not in the same domain? They are within the same Virtual Network, but in a Workgroup. So, obviously the IIS AppPoolIdentity account won't exist on the AppFabric VM. We've tried adding all possible built in accounts to the above mentioned Groups but it still doesn't work and we are still getting the Access to 'Globa' key is denied.

    Any ideas? This is becoming extremely frustrating!

    Thanks

    Ken

  4. davidqiu says:

    Hi Ken,

    The error in the blog post has nothing to do with AppFabric authorization that a server must grant client permissions to access the cache. The issue is local on the client machine. It seems your problem is AppFabric security on a workgroup environment. This set up is not supported in production per MSDN. You can try some workarounds if you still want to do it.

    Thanks,

    David

  5. Andrew says:

    Is this error/bahaviour still existing in version 1.1 CU5?

  6. davidqiu says:

    It exists in CU5. It is a design change that has been there since CU1..