Windows SBS 2011 Standard Known Post Installation Event Log Errors and Warnings

Known Post Installation Errors and Warnings

Problem: The following errors may be reported in the application event log:

Source: Microsoft-SharePoint Products-SharePoint Foundation
EventID: 6772
Message: There was an internal error invoking the timer job '{6486B72C-3B64-44D3-8117-1E48A4A1E4B8}' for service '{3099C545-3246-44A6-A610-C95D350C64D3}

Source: Microsoft-SharePoint Products-SharePoint Foundation
EventID: 6398
Message: The Execute method of job definition Microsoft.SharePoint.Search.Administration.SPSearchJobDefinition (ID 67371ad5-7be6-42ba-8b9b-30ae9c54d935) threw an exception. More information is included below. Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding

Resolution: The errors are benign and may be safely ignored.

Problem: The following error may be reported in the system event log:

Source: Microsoft-Windows-DistributedCOM
EventID: 10016
Message: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {61738644-F196-11D0-9953-00C04FD919C1} and APPID {61738644-F196-11D0-9953-00C04FD919C1} to the user CONTOSO\spfarm SID (S-1-5-21-1860903272-1458820992-1399837422-1157) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.


Cause: This issue occurs because the account that is configured as the Windows SharePoint Services service account does not have the Local Activation permission to the IIS Wamreg Admin Service. The event ID error message 10016 does not affect the functionality of Windows SharePoint Services.

Resolution: You can safely ignore the event ID error message 10016 that is logged in the System log. If you want to prevent the event ID error message from being logged in the System log, use the Component Services snap-in to enable the Local Activation permission to the IIS Wamreg Admin Service for the spfarm account. On Windows Small Business Server 2011 Standard, the administrator account doesn't have permissions by default to modify the IIS Wamreg Admin Service. 

You must first use the following steps to modify the permissions:


Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

1. Click Start, click Run, type Regedit on the Open box, and then click OK.
2. Navigate to the following registry key: HKEY_CLASSES_ROOT\AppID\{61738644-F196-11D0-9953-00C04FD919C1}
3. Right click on the key {61738644-F196-11D0-9953-00C04FD919C1} and choose permissions
4. Click Advanced button
5. Change to the Owner Tab
6. Change the Owner to the Administrators Group be sure to check the box labeled “Replace owner on subcontainers and objects”
7. Once the Owner is changed, go back to the security tab and Grant the Administrators group Full Control
8. Close Regedit

Use the following steps to grant the SPFARM account the local activation right.

1. Click Start, click Run, type dcomcnfg in the Open box, and then click OK. 
2. Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config. 
3. Right-click IIS WAMREG admin Service, and then click Properties. 
4. Click the Security tab. 
5. Under Launch and Activation Permissions, click Edit. 
6. Click on the SharePoint Farm Account and check the box for Local Activation.
7. Click OK and close out of the Component Services Utility.

Problem: The following error may be recorded in the MSExchange Management event log every 30 minutes

Log Name:      MSExchange Management
Source:        MSExchange CmdletLogs
Date:          12/22/2010 8:00:13 AM
Event ID:      6
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Description:
Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.

Cause: The error is generated by the Small Business Server datacollectorservice. When the datacollectorservice runs Exchange related tasks a check is performed to determine whether or not the current user is an Exchange admin and mail-enabled. The datacollectorservice runs under the context of the local system check so the check fails and the error is generated.

Resolution: The error is benign and may be safely ignored.

Problem: The following warnings may be reported in the application event log.

Log Name:      Application
Source:        VSS
Date:          12/22/2010 9:00:03 AM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key. Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Log Name:      Application
Source:        VSS
Date:          12/22/2010 9:00:03 AM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key. Operation:
   Gathering Writer Data
   Executing Asynchronous OperationContext:
   Execution Context: Requestor
   Current State: GatherWriterMetadataError-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Cause: The warnings occur because the Sharepoint VSS writer and search services run under the context of a domain user account.

Resolution: The warnings are benign and can be safely ignored.


Problem: The following errors may be reported in the Windows Remote Management Operational Event log

Log Name:      Microsoft-Windows-WinRM/Operational
Source:        Microsoft-Windows-WinRM
Date:          1/7/2011 10:00:18 AM
Event ID:      142
Task Category: Response handling
Level:         Error
Keywords:      Client
User:          SYSTEM
Computer:      CONTOSOSERVER.contoso.local
Description:
WSMan operation SignalShell failed, error code 995

Log Name:      Microsoft-Windows-WinRM/Operational
Source:        Microsoft-Windows-WinRM
Date:          1/7/2011 9:30:00 AM
Event ID:      129
Task Category: Response handling
Level:         Error
Keywords:      Client
User:          SYSTEM
Computer:      CONTOSOSERVER.contoso.local
Description:
Received the response from Network layer; status: 503 (HTTP_STATUS_SERVICE_UNAVAIL)

Cause: The errors occur when the Exchange Powershell connects to Windows Remote Management. They will appear even if the Exchange Powershell is closed because the SBS monitoring task uses Exchange Powershell to get some Exchange statistics.

Resolution: The errors are benign and can be safely ignored.