Data Does Not Appear in Azure Log Analytics Due to Profile

Symptoms

  • In some configurations, Azure Log Analytics assessment data collection will fail due to how user profiles are handled in windows.

  • The assessment's scheduled task executes successfully, but issue data never appears in the Azure Log Analytics workspace.

  • The assessment's discovery and/or execution logs contain the message, "Illegal operation attempted on a registry key that has been marked for deletion."

Cause

Windows may unload the user registry hive while in use by the assessment client application.

Resolution

Change the following setting in the group policy editor (gpedit.msc) from "not configured" to "enabled"

Location: Computer Configuration > Administrative Templates > System > User Profiles

Do not forcefully unload the user registry at user logoff.

Review the following article for detailed instructions: https://support.microsoft.com/en-us/help/2287297/a-com-application-may-stop-working-on-windows-server-2008-when-a-user

More Information

The problem is related to how remote PowerShell initializes and will only impact certain assessment types when the configured user is not logged on during task execution.

This problem is one of the primary causes of assessments ceasing to upload data unexpectedly. The admin user is logged on for the first execution that is scheduled 1 hour from installation. Then over time that account is logged off or the machine reboots, causing the next execution to silently fail.

For general feedback on the Resource Center or content, please submit your response to UserVoice. For specific requests and content updates regarding the Services Hub, contact our Support Team to submit a case.