We help IT Professionals succeed at work.

Windows 2019 Event 1015 Repeating

Thomas Grassi
Thomas Grassi used Ask the Experts™
Windows 2019 Data Center server.
ESXI 6.5

This server is part of my SharePoint Farm

Getting this warning over and over.

Log Name:      Application
Source:        MsiInstaller
Date:          12/23/2019 12:53:00 AM
Event ID:      1015
Task Category: None
Level:         Warning
Keywords:      Classic
User:          OUR\spfarm
Computer:      TGCS027-N1.our.network.tgcsnet.com
Failed to connect to server. Error: 0x80070005
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1015</EventID>
    <TimeCreated SystemTime="2019-12-23T05:53:00.463769000Z" />
    <Security UserID="S-1-5-21-3054588571-1341459584-784128302-3142" />

Open in new window

Any ideas on this?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
At a guess, a GPO that is designed to install a MSI that is not accessible to the computer or the user account.
Thomas GrassiSystems Administrator



Merry Christmas

No GPO that is not used on any other computer.  Only this computer has the problem.

Are you thinking the user account listed in the event needs to be in the local administrator group?

Update it is happing on my other Windows 2019 Server now also.
Thomas GrassiSystems Administrator


I tried these commands

msiexec /unreg

msiexec /regserver

No luck still getting the error

It happens once a day at around the same time 12:52 or 12:53 AM
Thomas GrassiSystems Administrator



Looks like some of the links I found  adding the spfarm account to the local administrators group.
You can not leave that account in the local administrators group SharePoint checks for that.

But the script in the article you provided adds the farm account to the group then restarts sptimerv4 service then removes the farm account from the group.  When I ran the job-admin-product-version sptimmerjob it did not throw any 1015 event they were 1035 which is informational.  Looks good.   I did this on NODE 1 going to run the same on NODE 2 then tonights at 12:53  will see what happens.

Will post results

Thank you
Thomas GrassiSystems Administrator


On one server it seems to cleared up still having same on server 2
Thomas GrassiSystems Administrator



I ran this on my server

PS C:\Users\spadmin> $farmAccountSAN = $farmAccountSplitted[1]
PS C:\Users\spadmin> $userPath = "WinNT://" + $farmAccountDomain + "/" + $farmAccountSAN + ",user"
PS C:\Users\spadmin> $groupPath = "WinNT://" + $env:COMPUTERNAME + "/" + $adminsGroup + ",group"
PS C:\Users\spadmin> $group = [ADSI]$groupPath
PS C:\Users\spadmin> $group.Add( $userPath )
PS C:\Users\spadmin> Restart-Service SPTimerV4
PS C:\Users\spadmin> $user = [ADSI]$userPath
PS C:\Users\spadmin> $group.Remove( $user.Path )
PS C:\Users\spadmin> Get-SPTimerJob job-admin-product-version | Start-SPTimerJob

Open in new window

This came from https://social.technet.microsoft.com/wiki/contents/articles/22908.sharepoint-2010-warning-1015-failed-to-connect-to-server-error-0x80070005.aspx

On Node 1 I ran this and now it cleared the events.  But on Node 2 I still get the events at the same time 12:51:41 AM

But now it is followed by an event 1035 which is informational saying that it installed the product.

any ideas?
Thomas GrassiSystems Administrator



On my Node 2 I created a script and set it up to run just before the SharePoint scheduled Job that causes the error.

Last night was the first time for the script and I was error free of 1015.

Thanks for your help.
Walter CurtisSharePoint AED
Distinguished Expert 2018

Glad that's working for you.

You mention above that SharePoint does not allow the farm account to be a local admin. It's will allow it, but it will also show it as an error message in Central Admin.

Note, Microsoft strongly recommends against doing this. But in order to provision some services the farm account needs to be a local admin on all SP servers while the service is being provisioned.  

Have a good one...