Saturday, February 21, 2009

Event ID : 6398 - WSS (IndexingScheduleJobDefinition - Access Denied)

It’s been three days I have been struggling with rectifying an insane error which keeps popping up in Windows Event Viewer under application category. I checked everything starting from permission settings on DCOM Component Services (OSearch) to recreating entire index and resetting all crawl rules and scopes, even creating new SSP. Steps as suggested in some Microsoft TechNet Posts are specified in my previous post, which did not help in full resolution of the issue. Following were the two errors which were giving me lot pain while setting up the environment. 

 Event ID 10016 and Event ID 6398

For resolution steps for Event 10016 click here.

Event ID 6398Windows SharePoint Services 3    Error  Timer  6398   N/A   WIN2K3R2EE    "The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition (ID b991a523-c9a3-402d-878c-31e7fa8b04b2) threw an exception. More information is included below.

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Root Cause Analysis:

Upon visiting following path: Central Administration > Operations > Timer Job Status I saw one of the job was failing each time. 

Indexing Schedule Manager on WIN2K3R2EE Failed 2/20/2009 6:00 PM  

Once Indexing Schedule Manager Timer Job was deactivated, alerts stopped coming. Upon reactivating, alerts appeared again. This seemed to be the culprit.

Next, I checked Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service Settings where I found Service Account was running under predefined "Network Service".

Under service account comments it said: "The search service account must not be a built-in account in order to access the database. Examples of built-in accounts are Local Service and Network Service."

Final point to take note of it, error states it’s a Windows SharePoint Services 3 Timer Error. I went ahead WSS Timer Service at Start > Administrative Tools > Services

As one can see in the the above figure Windows SharePoint Service Timer is running as Network Service and error showed as "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"


Following are the steps which helped me in resolving this issue.

1) Create new user account "X" (ensure accounts X have admin level privledges)

2) Associate account "X" with

i)  Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service

ii )Start > Administrative Tools > Services > Windows SharePoint Service Timer

This did the trick. Am not seeing any 6398 alerts any more.



jasbir said...

Thanks. That helped me immensely.

Lena said...

Thanks, that saved some time..

Maurice said...

Very nice :-)

Lena said...

No, after much trouble I found out that if you change the account for Timer Job, Mail-in to SharePoint will not work, and Workflows built in SharePoint Designer stop working. I´m back to square one, without a solution.

Car Auctions said...

You really share some interesting stuff over here, I recently come across you blog and admire much. All this article are very much helpful for me to fix my bugs.

Anonymous said...

Excellent post. I was checking continuously this blog and I'm impressed!
Extremely helpful information specifically the last part :) I care for such
info a lot. I was seeking this particular info for a very long
time. Thank you and best of luck.

Feel free to visit my web page :: click the next internet site ()

Haresh Gangwani said...

Excellent post.