asked on

Warning in sbs2011 server application event log - Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376

We have several small business 2011 to look after, and notice that on several of them we get repeated warnings in the application event log, as follows :-

Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

Error-specific details:
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Here is a typical screen shot :-

As I said, this is happening in several locations, and I would like to get to the bottom of it. It seems to be well documented, so it is frustrating that several of our sites display this behaviour.

I have followed a document which tells me to modify the registry by adding additional permissions etc, but this does not seem to make any difference.

Can anyone assist in getting to the bottom of this rather frustrating issue. It does not seem to affect anything, but I cannot be certain of this.

Any ideas??

David Atkin

Hello,

Check to see if you have any pending sharepoint updates by running the following command in an elevated sharepoint shell:

(get-spserver $env:computername).NeedsUpgrade

If the result is true then run this command to update sharepoint:

PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures

Once complete check to see if the warning still exists.

nigelbeatson

ASKER

It was "True"

I am now running the command suggested, and will let you know how that goes.

I have also noticed that the updates are not running on the server in general, si I presume I need to investigate that too.

Many Thanks

nigelbeatson

ASKER

I have updated sharepoint as suggested, but we still seem to be getting the VSS warnings, as per my screenshot below :-

David Atkin

Can you run 'vssadmin list writers' in an elevated command prompt. Check to see if any writers are in a failed state.

Presuming your backups are still working?

There are a few errors on that screen shot. Run the Best Practice Analyser and see if there any issues (print screen and paste onto here).

Dave

nigelbeatson

ASKER

vssadmin list writers :-

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line to
(C) Copyright 2001-2005 Microsoft Corp.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'SqlServerWriter'
Writer Id: {a65faa63-5ea8-4ebc-9dbd-a0c4db26912a}
Writer Instance Id: {1f2430f1-204a-4a16-81f6-0132e9d808d5}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {1f2459a1-ec0b-46ff-a2e5-81af51242023}
State: [1] Stable
Last error: No error

Writer name: 'FSRM Writer'
Writer Id: {12ce4370-5bb7-4c58-a76a-e5d5097e3674}
Writer Instance Id: {d5756ba5-2a26-4356-a033-bf62b0a804db}
State: [1] Stable
Last error: No error

Writer name: 'FRS Writer'
Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29}
Writer Instance Id: {4202eabe-5ae7-47c7-8293-bb66e72aca11}
State: [1] Stable
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {d86b9ac4-bb46-46c1-9b8e-68880c86e407}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {ad28c183-7e58-4048-bc0a-cb347b9d9593}
State: [1] Stable
Last error: No error

Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {708c378e-783f-43f0-a4e5-58d604344258}
State: [1] Stable
Last error: No error

Writer name: 'IIS Config Writer'
Writer Id: {2a40fd15-dfca-4aa8-a654-1f8c654603f6}
Writer Instance Id: {22b45b5c-6e16-4bd9-986c-6bca35538a71}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {a9885eac-7aff-4b72-97cd-0c7197b5bc19}
State: [1] Stable
Last error: No error

Writer name: 'TS Gateway Writer'
Writer Id: {368753ec-572e-4fc7-b4b9-ccd9bdc624cb}
Writer Instance Id: {aef9dfcb-55d8-4e25-a31b-9c6721e1c59a}
State: [1] Stable
Last error: No error

Writer name: 'NPS VSS Writer'
Writer Id: {35e81631-13e1-48db-97fc-d5bc721bb18a}
Writer Instance Id: {2a412ece-cded-49e1-9ad9-d7c925161ff1}
State: [1] Stable
Last error: No error

Writer name: 'Certificate Authority'
Writer Id: {6f5b15b5-da24-4d88-b737-63063e3a1f86}
Writer Instance Id: {ff53f599-211e-4172-8834-5ebf23700b78}
State: [1] Stable
Last error: No error

Writer name: 'Microsoft Exchange Writer'
Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
Writer Instance Id: {80c65dbd-7d6a-407a-b5a2-de2b9f8a178c}
State: [1] Stable
Last error: No error

Writer name: 'IIS Metabase Writer'
Writer Id: {59b1f0cf-90ef-465f-9609-6ca8b2938366}
Writer Instance Id: {bf819c5c-2280-4c70-b124-54682b2dd045}
State: [1] Stable
Last error: No error

Writer name: 'Dhcp Jet Writer'
Writer Id: {be9ac81e-3619-421f-920f-4c6fea9e93ad}
Writer Instance Id: {9d72fe2a-e87e-4085-8ec1-ef30a2db843f}
State: [1] Stable
Last error: No error

Writer name: 'NTDS'
Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
Writer Instance Id: {1e55c449-c008-4bd7-980c-f4a24ec39670}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {03f04f69-0770-43f3-831e-fe8c93e583b9}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {3eb0d1ff-48a4-41cb-8253-82a14cb9e72f}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {d2cf41ce-503f-4361-a1db-c79eed51fd7e}
State: [1] Stable
Last error: No error

C:\Windows\system32>

I have noticed that we have only had VSS warning again once this afternoon?? We do still do seem to have problems with the update and another regular warning as follows :-

Log Name: Application
Source: ASP.NET 2.0.50727.0
Date: 20/03/2015 15:41:33
Event ID: 1309
Task Category: Web Event
Level: Warning
Keywords: Classic
User: N/A
Computer: SBS2011.dolphinsheffield.co.uk
Description:
Event code: 3001
Event message: The request has been aborted.
Event time: 20/03/2015 15:41:33
Event time (UTC): 20/03/2015 15:41:33
Event ID: d21d8ee5ad5b4ef48b0a712d1ea3728c
Event sequence: 64
Event occurrence: 21
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1572271583/ROOT/ServerSyncWebService-6-130713254489131781
Trust level: Full
Application Virtual Path: /ServerSyncWebService
Application Path: C:\Program Files\Update Services\WebServices\ServerSyncWebService\
Machine name: SBS2011

Process information:
Process ID: 11524
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Exception information:
Exception type: HttpException
Exception message: Request timed out.

Request information:
Request URL: http://sbs2011:8530/ServerSyncWebService/serversyncwebservice.asmx
Request path: /ServerSyncWebService/serversyncwebservice.asmx
User host address: fe80::df3:6882:450b:f14cFull
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE

Thread information:
Thread ID: 25
Thread account name: NT AUTHORITY\NETWORK SERVICE
Is impersonating: False
Stack trace:

Custom event details:

Warning 20/03/2015 15:41:33 ASP.NET 2.0.50727.0 1309 Web Event

Event code: 3001
Event message: The request has been aborted.
Event time: 20/03/2015 15:41:33
Event time (UTC): 20/03/2015 15:41:33
Event ID: d21d8ee5ad5b4ef48b0a712d1ea3728c
Event sequence: 64
Event occurrence: 21
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1572271583/ROOT/ServerSyncWebService-6-130713254489131781
Trust level: Full
Application Virtual Path: /ServerSyncWebService
Application Path: C:\Program Files\Update Services\WebServices\ServerSyncWebService\
Machine name: SBS2011

Process information:
Process ID: 11524
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Exception information:
Exception type: HttpException
Exception message: Request timed out.

Request information:
Request URL: http://sbs2011:8530/ServerSyncWebService/serversyncwebservice.asmx
Request path: /ServerSyncWebService/serversyncwebservice.asmx
User host address: fe80::df3:6882:450b:f14cFull
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE

Thread information:
Thread ID: 25
Thread account name: NT AUTHORITY\NETWORK SERVICE
Is impersonating: False
Stack trace:

Custom event details:

I only enclose this just in case they are related.

The event log looks like this :-

We are running the Microsoft SBS Backup routine, to external USB drives, and this does seem to be working OK

Any ideas?

nigelbeatson

ASKER

Sorry, I have miss informed you, I have had a closer look in the event log, and the VSS wrning has occured several times since the update this morning.

ASKER CERTIFIED SOLUTION

nigelbeatson

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

nigelbeatson

ASKER

Not sure how to close and clear this question. Any advice would be appreciated.