Problem
=========
Windows 2003/Event 3083 window search Mapi2Handler.1 cannot be loaded
EventID:3083
Category: Gatherer
Description:The protocol handler Search.Mapi2Handler.1 cannot be loaded. Error
description: Class not registered
Desktop Search Version 4

Analyze
========
The background on this issue is that there are two processes that can index on 64-bit machines. One process is 64-bit and can load 64-bit protocol handlers and the other is a 32-bit process, which can load 32-bit protocol handlers. In this case, since mapi (which is used to index outlook email) is 32-bit only when the 64-bit protocol handler process starts it tries to load the 64-bit version of the non-existent mapi protocol handler. It should call into the WOW64-32 layer to determine that this handler is correctly registered in the other CLSID hive and not display the error. For some reason this check is not passing most likely due to some incompatible vista only flag we are using when calling to WOW64.32 bit applications use [HKEY_CLASSES_ROOT\Wow6432Node\CLSID64 bit applications use [HKEY_CLASSES_ROOT\CLSID


Solution
=======
Remove Windows Desktop Search or add the following registry entry

=====
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9E175BAF-F52A-11D8-B9A5-505054503030}]
@="Windows Search Service Office Outlook Protocol Handler"
[HKEY_CLASSES_ROOT\CLSID\{9E175BAF-F52A-11D8-B9A5-505054503030}\InprocServer32]
@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,73,00,\
  73,00,70,00,68,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"
[HKEY_CLASSES_ROOT\CLSID\{9E175BAF-F52A-11D8-B9A5-505054503030}\ProgID]
@="Search.MAPI2Handler.1"
[HKEY_CLASSES_ROOT\CLSID\{9E175BAF-F52A-11D8-B9A5-505054503030}\VersionIndependentProgID]
@="Search.MAPI2Handler"
=====

Problem
======
Monitoringhost.exe processes on the Root management server have handle/memory leak.

Solution
=========
Please apply .Net 2.0 hotfix 968760 and the SCOM 2007 SP1 CU1.
RELATED KNOWLEDGE BASE ARTICLES:

================================
.Net framework 2.0 SP2 update.
http://support.microsoft.com/?Id=968760

Cumulative rollup 1 for SCOM 2007 SP1:
http://support.microsoft.com/?Id=971541

Please refer the following steps for firewall setting of IIS RPC:

1. RPC dynamic port range:

*這是 Windows Server 2008 和 Windows Vista 中的範圍。

2. Steps of setting RPC dynamic port:
You can view the dynamic port range on a computer that is running Windows Vista or Windows Server 2008 computer by using the following netsh commands:
netsh int ipv4 show dynamicport tcp

     You adjust this range by using the netsh command, as follows:

      netsh int <ipv4|ipv6> set dynamic <tcp|udp> start=number num=range

     This command sets the dynamic port range for TCP. The start port is number, and the total number of ports is range. The following are sample commands:
netsh int ipv4 set dynamicport tcp start=50000 num=1000

3. Steps of firewall (For Windows Server 2008 R2)

For Windows Server 2008
Here is the following command that helps you do this:

Type in the following where the range is specified in ( ) and the name of the firewall entry is in " ".

FOR /L %I IN (5000,1,5100) DO netsh firewall add  portopening TCP %I "RPC PORTS"%I

Each port in the range will be added with an "OK" confirmation.

In my case I wanted to add ports from 5000 - 5100.

We can add or delete both TCP and UDP ports, to do this we need to make a slight change in the above command:

instead of TCP we need to specify UDP and instead of "add" specify "delete" .
Ref:

=====

Windows Server 系統的服務概觀和網路連接埠需求

http://support.microsoft.com/kb/832017/zh-tw

How to configure RPC to use certain ports and how to help secure those ports by using IPsec

http://support.microsoft.com/kb/908472/en-us

在 Windows Vista 和 Windows Server 2008 中，TCP/IP 的預設動態連接埠範圍已變更

http://support.microsoft.com/kb/929851/zh-tw

由以下SCCM Help做說明，目前的狀況是By Deign的行為，當User是Logoff或是Lock的情況下使用Remote tools會改轉為Remote Desktop這是因為Remote Tool無法Send出Ctrl+Alt+Delete組合鍵出去，因此當遇到用戶端登出或是鎖定時會轉為Remote Desktop

以下請參考

1. Delete subscription key and restart eventsystem and COM+ app services

2. Run “vssadmin list writers”

3. re-register all VSS binaries, then “vssadmin list writer” works.

a. Backup and remove register key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79

216}\Subscriptions

b. net stop “COM+ Event System”; confirm Y.

c. net stop “COM+ System Application “

d. net stop vss ;

e. net stop swprv

f. re-register all dlls.

regsvr32 vss_ddu.dll

regsvr32 ole32.dll

regsvr32 oleaut32.dll

regsvr32 vss_ps.dll

Vssvc.exe /Register

regsvr32 /I swprv.DLL

regsvr32 /I EVENTCLS.DLL

regsvr32 ES.DLL

regsvr32 stdprov.dll

regsvr32 vssui.dll

regsvr32 msxml3.dll

g. net start “COM+ Event System”;

h. net start “COM+ System Application“

i. net stop vss ;

j. net stop swprv

k. after these steps, the registry will be re-created.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79

216}\Subscriptions