ENTSSO fails every time I restarts in single node machine

Question

I've BizTalk and SQL Server in the same machine(Standalone)

Whenever I restarting my PC I'm receiving the below error. Because of this I couldn't turn on/off applications, send ports, receive locations....

To solve this every time I need to go to Services and restart ENTSSO.

Why it's happening every time I restarts and how to resolve this?

In Event Viewer:

SSO AUDIT Function: GetConfigInfo ({8A5EE21D-E240-47F8-A386-XXXXXXXXXXX}) Tracking ID: a12b49dd-XXXX-XXXX-95b9-000dc439252e Client Computer:XXXXXXXXXXXXXXXXXXXXXX (BTSNTSvc64.exe:XXXXX) Client User: XXXXXXXXXXXXXXXXXXXX Application Name: {111C63C7-XXXX-XXXX-XXXX-248AEC9E0BCC} Error Code: 0xC0002A1F, Cannot perform encryption or decryption because the secret is not available from the master secret server. See the event log for related errors.

In Admin Console:

In Windows Events

SSO AUDIT Function: GetFieldInfo Tracking ID: 2fcxxb3d-xxxx-4c4e-xxxx-37x3ec9xxxd1 Client Computer: ComputerNameXXX (mmc.exe:1XXX2) Client User: UserName Application Name: {2xxxx06A-xxxx-xxxx-xxxx-B3A629ACxxx9} Error Code: 0x800703FA, Illegal operation attempted on a registry key that has been marked for deletion

Answer 1

That error code indicates that someone is logging onto the server using the same account that SSO is running under see the below. It is talking about SharePoint rather than BizTalk however.

"800703fa Illegal operation attempted on a registry key" error

This problem typically occurs after an administrator uses a service account to log on to the server for an interactive session, and then logs off. For example, an administrator may log on to a Web Front End (WFE) server by using the farm account, and then log off. This activity forces the registry keys to be unloaded in the profile of that account. This condition makes the keys unavailable for future use.

The SSO Service (or BizTalk Services) should not run under an Administration account as that is bad security. They should be running under a service account that does not allow RDP logins.