Warning in sbs2011 server application event log - Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376

We have several small business 2011 to look after, and notice that on several of them we get repeated warnings in the application event log, as follows :-

Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Here is a typical screen shot :-


VSS warning

As I said, this is happening in several locations, and I would like to get to the bottom of it. It seems to be well documented, so it is frustrating that several of our sites display this behaviour.

I have followed a document which tells me to modify the registry by adding additional permissions etc, but this does not seem to make any difference.

Can anyone assist in getting to the bottom of this rather frustrating issue. It does not seem to affect anything, but I cannot be certain of this.

Any ideas??
LVL 1
nigelbeatsonAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David AtkinTechnical DirectorCommented:
Hello,

Check to see if you have any pending sharepoint updates by running the following command in an elevated sharepoint shell:

(get-spserver $env:computername).NeedsUpgrade

If the result is true then run this command to update sharepoint:

PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures


Once complete check to see if the warning still exists.
nigelbeatsonAuthor Commented:
It was "True"

I am now running the command suggested, and will let you know how that goes.

I have also noticed that the updates are not running on the server in general, si I presume I need to investigate that too.

Many Thanks
nigelbeatsonAuthor Commented:
I have updated sharepoint as suggested, but we still seem to be getting the VSS warnings, as per my screenshot below :-

dolphinss.jpg
Learn Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

David AtkinTechnical DirectorCommented:
Can you run 'vssadmin list writers' in an elevated command prompt.  Check to see if any writers are in a failed state.

Presuming your backups are still working?

There are a few errors on that screen shot.  Run the Best Practice Analyser and see if there any issues (print screen and paste onto here).

Dave
nigelbeatsonAuthor Commented:
vssadmin list writers :-

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line to
(C) Copyright 2001-2005 Microsoft Corp.

Writer name: 'Task Scheduler Writer'
   Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
   Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
   State: [1] Stable
   Last error: No error

Writer name: 'VSS Metadata Store Writer'
   Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
   Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
   State: [1] Stable
   Last error: No error

Writer name: 'Performance Counters Writer'
   Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
   Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
   State: [1] Stable
   Last error: No error

Writer name: 'SqlServerWriter'
   Writer Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
   Writer Instance Id: {1f2430f1-204a-4a16-81f6-0132e9d808d5}
   State: [1] Stable
   Last error: No error

Writer name: 'System Writer'
   Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Instance Id: {1f2459a1-ec0b-46ff-a2e5-81af51242023}
   State: [1] Stable
   Last error: No error

Writer name: 'FSRM Writer'
   Writer Id: {12ce4370-5bb7-4c58-a76a-e5d5097e3674}
   Writer Instance Id: {d5756ba5-2a26-4356-a033-bf62b0a804db}
   State: [1] Stable
   Last error: No error

Writer name: 'FRS Writer'
   Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29}
   Writer Instance Id: {4202eabe-5ae7-47c7-8293-bb66e72aca11}
   State: [1] Stable
   Last error: No error

Writer name: 'ASR Writer'
   Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
   Writer Instance Id: {d86b9ac4-bb46-46c1-9b8e-68880c86e407}
   State: [1] Stable
   Last error: No error

Writer name: 'MSSearch Service Writer'
   Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
   Writer Instance Id: {ad28c183-7e58-4048-bc0a-cb347b9d9593}
   State: [1] Stable
   Last error: No error

Writer name: 'BITS Writer'
   Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
   Writer Instance Id: {708c378e-783f-43f0-a4e5-58d604344258}
   State: [1] Stable
   Last error: No error

Writer name: 'IIS Config Writer'
   Writer Id: {2a40fd15-dfca-4aa8-a654-1f8c654603f6}
   Writer Instance Id: {22b45b5c-6e16-4bd9-986c-6bca35538a71}
   State: [1] Stable
   Last error: No error

Writer name: 'WMI Writer'
   Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Writer Instance Id: {a9885eac-7aff-4b72-97cd-0c7197b5bc19}
   State: [1] Stable
   Last error: No error

Writer name: 'TS Gateway Writer'
   Writer Id: {368753ec-572e-4fc7-b4b9-ccd9bdc624cb}
   Writer Instance Id: {aef9dfcb-55d8-4e25-a31b-9c6721e1c59a}
   State: [1] Stable
   Last error: No error

Writer name: 'NPS VSS Writer'
   Writer Id: {35e81631-13e1-48db-97fc-d5bc721bb18a}
   Writer Instance Id: {2a412ece-cded-49e1-9ad9-d7c925161ff1}
   State: [1] Stable
   Last error: No error

Writer name: 'Certificate Authority'
   Writer Id: {6f5b15b5-da24-4d88-b737-63063e3a1f86}
   Writer Instance Id: {ff53f599-211e-4172-8834-5ebf23700b78}
   State: [1] Stable
   Last error: No error

Writer name: 'Microsoft Exchange Writer'
   Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
   Writer Instance Id: {80c65dbd-7d6a-407a-b5a2-de2b9f8a178c}
   State: [1] Stable
   Last error: No error

Writer name: 'IIS Metabase Writer'
   Writer Id: {59b1f0cf-90ef-465f-9609-6ca8b2938366}
   Writer Instance Id: {bf819c5c-2280-4c70-b124-54682b2dd045}
   State: [1] Stable
   Last error: No error

Writer name: 'Dhcp Jet Writer'
   Writer Id: {be9ac81e-3619-421f-920f-4c6fea9e93ad}
   Writer Instance Id: {9d72fe2a-e87e-4085-8ec1-ef30a2db843f}
   State: [1] Stable
   Last error: No error

Writer name: 'NTDS'
   Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Instance Id: {1e55c449-c008-4bd7-980c-f4a24ec39670}
   State: [1] Stable
   Last error: No error

Writer name: 'Registry Writer'
   Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Writer Instance Id: {03f04f69-0770-43f3-831e-fe8c93e583b9}
   State: [1] Stable
   Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
   Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Instance Id: {3eb0d1ff-48a4-41cb-8253-82a14cb9e72f}
   State: [1] Stable
   Last error: No error

Writer name: 'COM+ REGDB Writer'
   Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Writer Instance Id: {d2cf41ce-503f-4361-a1db-c79eed51fd7e}
   State: [1] Stable
   Last error: No error


C:\Windows\system32>


I have noticed that we have only had VSS warning again once this afternoon?? We do still do seem to have problems with the update and another regular warning as follows :-

Log Name:      Application
Source:        ASP.NET 2.0.50727.0
Date:          20/03/2015 15:41:33
Event ID:      1309
Task Category: Web Event
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SBS2011.dolphinsheffield.co.uk
Description:
Event code: 3001
Event message: The request has been aborted.
Event time: 20/03/2015 15:41:33
Event time (UTC): 20/03/2015 15:41:33
Event ID: d21d8ee5ad5b4ef48b0a712d1ea3728c
Event sequence: 64
Event occurrence: 21
Event detail code: 0
 
Application information:
    Application domain: /LM/W3SVC/1572271583/ROOT/ServerSyncWebService-6-130713254489131781
    Trust level: Full
    Application Virtual Path: /ServerSyncWebService
    Application Path: C:\Program Files\Update Services\WebServices\ServerSyncWebService\
    Machine name: SBS2011
 
Process information:
    Process ID: 11524
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE
 
Exception information:
    Exception type: HttpException
    Exception message: Request timed out.
 
Request information:
    Request URL: http://sbs2011:8530/ServerSyncWebService/serversyncwebservice.asmx 
    Request path: /ServerSyncWebService/serversyncwebservice.asmx
    User host address: fe80::df3:6882:450b:f14cFull
    User:  
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
 
Thread information:
    Thread ID: 25
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:
 
 
Custom event details:

Warning      20/03/2015 15:41:33      ASP.NET 2.0.50727.0      1309      Web Event

Event code: 3001
Event message: The request has been aborted.
Event time: 20/03/2015 15:41:33
Event time (UTC): 20/03/2015 15:41:33
Event ID: d21d8ee5ad5b4ef48b0a712d1ea3728c
Event sequence: 64
Event occurrence: 21
Event detail code: 0
 
Application information:
    Application domain: /LM/W3SVC/1572271583/ROOT/ServerSyncWebService-6-130713254489131781
    Trust level: Full
    Application Virtual Path: /ServerSyncWebService
    Application Path: C:\Program Files\Update Services\WebServices\ServerSyncWebService\
    Machine name: SBS2011
 
Process information:
    Process ID: 11524
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE
 
Exception information:
    Exception type: HttpException
    Exception message: Request timed out.
 
Request information:
    Request URL: http://sbs2011:8530/ServerSyncWebService/serversyncwebservice.asmx 
    Request path: /ServerSyncWebService/serversyncwebservice.asmx
    User host address: fe80::df3:6882:450b:f14cFull
    User:  
    Is authenticated: False
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE
 
Thread information:
    Thread ID: 25
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:
 
 
Custom event details:


I only enclose this just in case they are related.

The event log looks like this :-

vss2.jpg

We are running the Microsoft SBS Backup routine, to external USB drives, and this does seem to be working OK

Any ideas?
nigelbeatsonAuthor Commented:
Sorry, I have miss informed you, I have had a closer look in the event log, and the VSS wrning has occured several times since the update this morning.
nigelbeatsonAuthor Commented:
not sure what to do with this question, as we have since replaced the server, as we had so many different problems, so we never actually resolved this issue.

Can the question be closed?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
nigelbeatsonAuthor Commented:
Not sure how to close and clear this question. Any advice would be appreciated.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.