We were getting an error on one of our Load balanced web servers.

First of all we got “Attempted to read write to protected memory” error followed by the “The path specified cannot be used at this time” which is then logged every minute in the event viewer on our server.

This then ends up using all the resources on that server, which then makes the server become unavailable. Once the machine becomes unavailable it will move onto the next server and kill that one.

This was reported to Microsoft support and they identified it as a bug that will be fixed in SP1.

In the meantime the following will need to be done to work around this problem.

  1. Install the following hotfix 923028
  2. Retype the password for the search service from The central administrator page.
  3. Run “services.msc” and select the Windows SharePoint Services Timer
  4. Make sure the service is running with a MOSS service account, if it is running with MOSS services account then stop the service, retype the password and then start the service account again.
  5. Install / script a tool that automatically restarts the Windows SharePoint Services Timer when the following Event IDs are raised; 6398, 6482 and 7076. Microsoft Support maybe able to provide you with this tool if you raise a support request with them.

This is a particularly scary bug to be appearing in a “Production” ready product, especially as it is only happening in the farm environment and can take down you whole farm.

I believe there needs to be more information on the whole way SharePoint propagates between servers in a farm, there seems to be little understanding of it presently.