SBS 2011: VSS 8230 errors relating to Sharepoint search

[guest]

Anyone else seen errors in their event log relating to VSS and the Sharepoint search user? I was getting these errors before installing the Sharepoint 2010 updates, although I did get hit by the incorrect perms on the Sharepoint logs folder as well.

Here is the error I am getting quite frequently in the log:

Log Name: Application
Source: VSS
Date: 09/01/2011 23:51:48
Event ID: 8230
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: ELROND.hodgsonfamily.org
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

Operation:
Initializing Writer

Context:
Writer Class Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Name: BITS Writer

Error-specific details:
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8230</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-01-09T23:51:48.000000000Z" />
<EventRecordID>5183</EventRecordID>
<Channel>Application</Channel>
<Computer>MACHINE.domain.org</Computer>
<Security />
</System>
<EventData>
<Data>spsearch</Data>
<Data>1376</Data>
<Data>

Operation:
Initializing Writer

Context:
Writer Class Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Name: BITS Writer

Error-specific details:
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.
</Data>
<Binary>2D20436F64653A20534543534543524330303030313937322D2043616C6C3A20534543534543524330303030313735362D205049443A202030303030303930382D205449443A202030303030363439362D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B206E6574737663732020202020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
</EventData>
</Event>

[guest]

not yet published:
2483007 Windows SBS 2011 Known Post Installation Event Log
Errors and Warnings

http://support.microsoft.com/default.as ... US;2483007

SUMMARY

This article lists the known Post Installation Event Errors that may
occur on Windows Small Business Server 2011.

MORE INFORMATION

Known Post Installation Errors and Warnings

Problem: The following errors may be reported in the application event log:

Source: Microsoft-SharePoint Products-SharePoint Foundation
EventID: 6772
Message: There was an internal error invoking the timer job
'{6486B72C-3B64-44D3-8117-1E48A4A1E4B8}' for service
'{3099C545-3246-44A6-A610-C95D350C64D3}

Source: Microsoft-SharePoint Products-SharePoint Foundation
EventID: 6398
Message: The Execute method of job definition
Microsoft.SharePoint.Search.Administration.SPSearchJobDefinition (ID
67371ad5-7be6-42ba-8b9b-30ae9c54d935) threw an exception. More
information is included below. Timeout expired. The timeout period
elapsed prior to completion of the operation or the server is not responding

Resolution: The errors are benign and may be safely ignored.

Problem: The following error may be reported in the system event log:

Source: Microsoft-Windows-DistributedCOM
EventID: 10016
Message: The application-specific permission settings do not grant Local
Activation permission for the COM Server application with CLSID
{61738644-F196-11D0-9953-00C04FD919C1} and APPID
{61738644-F196-11D0-9953-00C04FD919C1} to the user CONTOSO\spfarm SID
(S-1-5-21-1860903272-1458820992-1399837422-1157) from address LocalHost
(Using LRPC). This security permission can be modified using the
Component Services administrative tool.
Cause: This issue occurs because the account that is configured as the
Windows SharePoint Services service account does not have the Local
Activation permission to the IIS Wamreg Admin Service. The event ID
error message 10016 does not affect the functionality of Windows
SharePoint Services.

Resolution: You can safely ignore the event ID error message 10016 that
is logged in the System log. If you want to prevent the event ID error
message from being logged in the System log, use the Component Services
snap-in to enable the Local Activation permission to the IIS Wamreg
Admin Service for the spfarm account. On Windows Small Business Server
2011, the administrator account doesn't have permissions by default to
modify the IIS Wamreg Admin Service.

You must first use the following steps to modify the permissions:
Important This article contains information about how to modify the
registry. Make sure that you back up the registry before you modify it.
Make sure that you know how to restore the registry if a problem occurs.
For more information about how to back up, restore, and modify the
registry, click the following article number to view the article in the
Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

1.

Click Start , click Run , type Regedit on the Open box, and then click OK .

2.

Navigate to the following registry key:
HKEY_CLASSES_ROOT\AppID\{61738644-F196-11D0-9953-00C04FD919C1}

3.

Right click on the key {61738644-F196-11D0-9953-00C04FD919C1} and choose
permissions

4.

Grant the Administrators group Full Control

5.

Close Regedit

Use the following steps to grant the SPFARM account the local activation
right.

1.

Click Start , click Run , type dcomcnfg in the Open box, and then
click OK .

2.

Expand Component Services , expand Computers , expand My Computer ,
and then click DCOM Config .

3.

Right-click IIS WAMREG admin Service , and then click Properties .

4.

Click the Security tab.

5.

Under Launch and Activation Permissions , click Edit .

6.

Click on the SharePoint Farm Account and check the box for Local
Activation .

7.

Click OK and close out of the Component Services Utility.
Problem: The following error may be recorded in the MSExchange
Management event log every 30 minutes

Log Name: MSExchange Management
Source: MSExchange CmdletLogs
Date: 12/22/2010 8:00:13 AM
Event ID: 6
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: CONTOSOSERVER.contoso.local
Description:
Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.

Cause: The error is generated by the Small Business Server
datacollectorservice. When the datacollectorservice runs Exchange
related tasks a check is performed to determine whether or not the
current user is an Exchange admin and mail-enabled. The
datacollectorservice runs under the context of the local system check so
the check fails and the error is generated.

Resolution: The error is benign and may be safely ignored.

Problem: The following warnings may be reported in the application event
log.

Log Name: Application
Source: VSS
Date: 12/22/2010 9:00:03 AM
Event ID: 8230
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: CONTOSOSERVER.contoso.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with
status 1376. Check connection to domain controller and VssAccessControl
registry key. Error-specific details:
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified
local group does not exist.

Log Name: Application
Source: VSS
Date: 12/22/2010 9:00:03 AM
Event ID: 8230
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: CONTOSOSERVER.contoso.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with
status 1376. Check connection to domain controller and VssAccessControl
registry key. Operation:
Gathering Writer Data
Executing Asynchronous OperationContext:
Execution Context: Requestor
Current State: GatherWriterMetadataError-specific details:
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified
local group does not exist.

Cause: The warnings occur because the Sharepoint VSS writer and search
services run under the context of a domain user account.

Resolution: The warnings are benign and can be safely ignored.