System.UnauthorizedAccessException Access to the registry key - iis

Question

I have some code that calls the TFS API and returns team meta data. (e.g. team names, area paths, etc.) The code works fine locally in Visual Studio ASP.NET MVC project, but fails whenever I deploy to the server.
What I have tried that didn't work:
I granted the AppPool user account Full control to the registry key (did not work)
Also, tried granting Everyone Full Control to the registry key (still did not work)
Any insight into how to set up the correct permissions of configuration for IIS deployed apps to hit the TFS API would be greatly appreciated. (error message below)
Here's the Error message the app produces:
System.UnauthorizedAccessException
Access to the registry key 'HKEY_CURRENT_USER\Software\Microsoft\VSCommon\12.0\ClientServices\TokenStorage\VisualStudio' is denied.
System.UnauthorizedAccessException: Access to the registry key 'HKEY_CURRENT_USER\Software\Microsoft\VSCommon\12.0\ClientServices\TokenStorage\VisualStudio' is denied.
at Microsoft.Win32.RegistryKey.Win32Error(Int32 errorCode, String str)
at Microsoft.Win32.RegistryKey.CreateSubKeyInternal(String subkey, RegistryKeyPermissionCheck permissionCheck, Object registrySecurityObj, RegistryOptions registryOptions)
at Microsoft.Win32.RegistryKey.CreateSubKey(String subkey, RegistryKeyPermissionCheck permissionCheck, RegistryOptions options)
at Microsoft.VisualStudio.Services.Common.TokenStorage.RegistryTokenStorageHelper.GetRootKey(String subkeyName)
at Microsoft.VisualStudio.Services.Common.TokenStorage.RegistryTokenStorage.RetrieveToken(VssTokenKey tokenKey)
at Microsoft.TeamFoundation.Client.TfsClientCredentialStorage.RetrieveToken(Uri serverUrl, VssCredentialsType credentialType)
at Microsoft.TeamFoundation.Client.CookieCredential.OnCreateTokenProvider(Uri serverUrl, HttpWebResponse response)
at Microsoft.TeamFoundation.Client.IssuedTokenCredential.CreateTokenProvider(Uri serverUrl, HttpWebResponse response, IssuedToken failedToken)
at Microsoft.TeamFoundation.Client.TfsClientCredentials.TryGetTokenProvider(Uri serverUrl, IssuedTokenProvider& provider)
at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestHelpers.PrepareWebRequest(HttpWebRequest webRequest, Guid sessionId, String operationName, CultureInfo cultureInfo, TfsRequestSettings settings, TfsClientCredentials credentials, IdentityDescriptor impersonate, IssuedToken& currentToken, IssuedTokenProvider& tokenProvider)
at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestHelpers.CreateSoapRequest(Uri requestUri, Guid sessionId, String soapAction, String operationName, CultureInfo cultureInfo, TfsRequestSettings settings, TfsClientCredentials credentials, IdentityDescriptor impersonate, IssuedToken& currentToken, IssuedTokenProvider& tokenProvider)
at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.CreateWebRequest()
at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequest()
at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestChannel.Request(TfsMessage message, TimeSpan timeout)
at Microsoft.TeamFoundation.Client.Channels.TfsHttpClientBase.Invoke(TfsClientOperation operation, Object[] parameters, TimeSpan timeout, Object[]& outputs)
at Microsoft.TeamFoundation.Framework.Client.RegistrationProxy.GetRegistrationEntries(String toolId)
at Microsoft.TeamFoundation.Framework.Client.RegistrationService.RefreshMemoryCache()
at Microsoft.TeamFoundation.Framework.Client.RegistrationService.Microsoft.TeamFoundation.Server.IRegistration.GetRegistrationEntries(String toolId)
at Microsoft.TeamFoundation.Framework.Client.IdentityManagementService..ctor(TfsConnection tfsBase)
at Microsoft.TeamFoundation.Framework.Client.IdentityManagementService2..ctor(TfsConnection tfsBase)
at Microsoft.TeamFoundation.Client.TfsConnection.CreateInternalProxy(Type serviceType)
at Microsoft.TeamFoundation.Client.TfsConnection.GetServiceInstance(Type serviceType, Object serviceInstance)
at Microsoft.TeamFoundation.Client.TfsConnection.GetService(Type serviceType)
at Microsoft.TeamFoundation.Client.TfsConnection.GetService[T]()
at Microsoft.TeamFoundation.Client.TfsTeamService.QueryTeams(String projectId)

Answer 1

I have been having the same problem and have solved it by setting the "Load User Profile" in IIS application pool settings to True.
I don't know if this is some new dependency in TFS 2013 or whether IIS 8.5 has changed the default, but this fixes it for me.

Answer 2

I ran into this same issue, but setting Load User Profile to TRUE didn't work for me. What did eventually work was going into the registry and adding a "HKCU\Software\Microsoft\VSCommon\12.0\ClientServices" key for the appropriate user(s). Apparently the TFS assemblies get a little cranky when you try to use them on systems without Visual Studio installed on them.
Credit goes to whoever added this information to http://msdn.developer-works.com/article/12173562/After+upgrade+from+TFS+2010+to+TFS+2013+the+soap+notifications+stop+working.

Answer 3

We had this issue and setting the "Load User Profile" in IIS application pool settings to True worked for us. But then the same issue came back and we found setting "Load User Profile" in IIS application pool settings to False fixed the issue once again. So it appears to me that it is the toggling of this setting that is fixing something rather than the actual value it is set to. No matter what "Load User Profile" in IIS application pool is set to, I would try toggling it to the opposite value, refresh the application pool and see if that helps. If anyone tracks down the root cause of this please share.