Windows SBS 2008 Known Post Installation Event Errors

This article lists Known Post Installation Event Errors from SBS 2008.

1Known Post Installation Events

1.1DCOM Event ID 10016

Problem: You install Microsoft Windows SharePoint Services 3.0. When you view the System log after Windows SharePoint Services 3.0 is successfully installed, you see the event ID 10016 error message logged one or more times.




Resolution: The solution in this article will work for Windows Small Business Server.


http://support.microsoft.com/kb/920783

Below is a summary of the posted article


Type: Error


Source: DCOM


Category: None


Event ID: 10016
Description:
The application-specific permissions settings do not grant Local Activation permission for the COM Server application with CLSID {CLSID} to the user DomainName\UserName SID {SID}. This security permission can be modified using the Component Services administration tool.




1.2 MSExchange Search Event ID 4625

Problem: Failed Security audits in the Security log. There is a problem in Microsoft.Exchange.Search.ExSearch.exe where an event ID 4625 will be reported every few minutes.




Resolution: This should be fixed in the Exchange Rollup Update 4 release which is currently targeted to be released in September of 2008. It can be ignored otherwise.




1.3MSExchange Event ID 4001 : MSExchange System Attendent Mailbox

Problem: This event happens around a reboot and clears up. There is no known side affect except for the error events remaining in the event log.




More Information:

http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=8.0&EvtID=4001&EvtSrc=MSExchange%20System%20Attendant%20Mailbox&LCID=1033



1.4MSExchange Event ID 8213: MSExchangeFBPublish

Problem: After you install Microsoft Exchange Server (installed during SBS2008 setup) the following event may appear in the Application log:


Event Type: Error
Event Source: MSExchangeFBPublish
Event Category: General
Event ID: 8213
Description: System Attendant Service failed to create session for virtual machine computername. The error number is 0x80044501.




Resolution: Refer to this article for steps to resolve this problem. The solution in this article will work for Windows Small Business Server.http://support.microsoft.com/kb/296151



1.5Miscellaneous error messages logged in the event viewer after OS installation.

Problem: After a successful installation there may be error events logged to the event viewer by programs or services that want to connect to the internet when there is no internet connectivity yet. For example, Forefront Security for Exchange Server (FSE) attempts to update its engines post installation and then on an hourly basis. Without internet connectivity, FSE will generate error events like the one below.




Log Name: Application


Source: GetEngineFiles


Event ID: 6014


Task Category: (6)


Level: Error


Keywords: Classic


User: N/A


Computer: SERVER.domain.local


Description:


Microsoft Forefront Server Security encountered an error while performing a scan engine update.


Scan Engine: Norman


Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman


Proxy Settings: Disabled


Error Code: 0x80004005


Description: An error occurred while checking if an update was available.




Resolution:


1. After setup has completed, open the Windows SBS Console.


2. From the Home Page, in the Getting Started Tasks, click Connect to the Internet. This wizard will configure the server and network to connect to the Internet.




2Other – Known Events

2.1DCOM Event ID 10009:

Problem: The DCOM event ID 10009 will occur when a client workstation has a misconfigured firewall or other issues affecting its network communications within the domain. For example, if the workstation is not managed by an SBS GPO. In this scenario, the DCOM event ID 10009 will happen repeatedly, potentially hundreds per day.




Resolution: To attempt to resolve configuration issues with the firewall try the following:

• Make sure to allow remote management exception. Depending on your firewall solution this might be implemented or might require opening several ports. Unfortunately, this means opening common ports like TCP/135, TCP/139 but also a range of dynamic ports that cannot easily be defined and start at 1025. Check with your firewall manufacturer for the proper ways of allowing dynamic RPC traffic.

• If the workstation is on a different subnet than the SBS server and it is running Windows XP SP2 or higher, the firewall exceptions provided by the SBS group policies will not properly allow the required connectivity. You should edit the Client XP GPO and change the scope of the rules to allow subnet + the internal IP of the server. Follow the extra steps below to properly monitor XP SP2 (or higher) machines running in the SBS domain on different subnets than the SBS server, and prevent the DCOM event ID 10009 errors if that is the case.

1. Click Start, click Run, type GPMC.MSC, and click OK.


2. Click Continue on the UAC prompt.


3. Expand Forest: Domain.local, Domains, Domain.local and select Group Policy Objects. (Replace Domain.local with your domain)


4. Right-click the Windows SBS Client – Windows XP Policy and click Edit.


5. Expand Computer Configuration, Policies, Administrative Templates, Network, Network Connections, Windows Firewall, Domain Profile.


6. Find the IP Address of the server: Open a command prompt window (cmd.exe) from the Start menu. In the command prompt window type IPConfig and press return. Make note of the IPv4 address listed.


7. In the Group Policy Management Editor, double click Windows Firewall: Allow inbound file and printer sharing exception

a. In the text box labeled Allow unsolicited incoming messages from these IP addresses, add the IP (IPv4) of the server. For example, if the IP of the server is 192.168.1.2, the text box should read: localsubnet,192.168.1.2.


b. Click OK.


8. Repeat Steps 7.a and 7.b for the following rules:


Windows Firewall: Allow inbound remote administration exception

Windows Firewall: Allow inbound remote desktop exceptions



2.2 MSExchangeFBPublish Event ID 8206, Windows Sharepoint Service 3 Event IDs 5586, 10036, 6398



Problem: Critical alerts are raised by Exchange and SharePoint applications in the event viewer when using the Move data folders wizard, or commandlets for the two applications.




Description: During the move of Exchange and Windows SharePoint Services data, several services are stopped, and hence any application dependent on them might raise critical alerts. The move process ensures that the applications are in a consistent state after the move and then reports a success. These alerts are expected and users should ignore all such events occurring during a move process.

Resolution: Users should ignore all critical alerts during a move if the Move operation completes successfully. If there are errors during a move the alerts are more relevant and may help diagnose specific issues that may have happened during the move.

More Information:
For more information on critical alerts raised by Exchange during move process please refer to the following Knowledge base article:
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=8.0&EvtID=8206&EvtSrc=MSExchangeFBPublish

For moving Sharepoint database the move application locks down the read/write access of the sharepoint site, It then moves the database to new location, checks for errors during move and then re-enables the sharepoint site for access. The process also initiates an HTTP request to sharepoint site and verifies that the site is up and running. During the lockdown, some other services which depended on the availability of the site like Search, Indexing, scheduled jobs of Sharepoint etc. may raise critical alerts in event viewer.