Event ID : 6398 - WSS (IndexingScheduleJobDefinition - Access Denied)

It’s been three days I have been struggling with rectifying an insane error which keeps popping up in Windows Event Viewer under application category. I checked everything starting from permission settings on DCOM Component Services (OSearch) to recreating entire index and resetting all crawl rules and scopes, even creating new SSP. Steps as suggested in some Microsoft TechNet Posts are specified in my previous post, which did not help in full resolution of the issue. Following were the two errors which were giving me lot pain while setting up the environment. 

 Event ID 10016 and Event ID 6398

For resolution steps for Event 10016 click here.

Event ID 6398: Windows SharePoint Services 3    Error  Timer  6398   N/A   WIN2K3R2EE    "The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition (ID b991a523-c9a3-402d-878c-31e7fa8b04b2) threw an exception. More information is included below.

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Root Cause Analysis:

Upon visiting following path: Central Administration > Operations > Timer Job Status I saw one of the job was failing each time. 

Indexing Schedule Manager on WIN2K3R2EE Failed 2/20/2009 6:00 PM  

Once Indexing Schedule Manager Timer Job was deactivated, alerts stopped coming. Upon reactivating, alerts appeared again. This seemed to be the culprit.

Next, I checked Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service Settings where I found Service Account was running under predefined "Network Service".

Under service account comments it said: "The search service account must not be a built-in account in order to access the database. Examples of built-in accounts are Local Service and Network Service."

Final point to take note of it, error states it’s a Windows SharePoint Services 3 Timer Error. I went ahead WSS Timer Service at Start > Administrative Tools > Services

As one can see in the the above figure Windows SharePoint Service Timer is running as Network Service and error showed as "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Solution:

Following are the steps which helped me in resolving this issue.

1) Create new user account "X" (ensure accounts X have admin level privledges)

2) Associate account "X" with

i)  Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service

ii )Start > Administrative Tools > Services > Windows SharePoint Service Timer

This did the trick. Am not seeing any 6398 alerts any more.

Cheers

Event ID 10016 and Event ID 6398

Recently, I am working on to build a SharePoint environment for my team. This is a brand new environment. So I created the AD accounts and did all those steps, account delegation stuff. Created the sites/site collections following our build docs. Everything was working out fine to a point where things started falling apart. I narrowed down the problem to following errors, which I dug up from windows application event viewer.

• Event ID 10016 : Local Activation permission for the COM Server application with CLSID {61738644-F196-11D0-9953-00C04FD919C1}
• Event ID 6398: The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition

Solutions -

Event ID 10016 :

To prevent the event ID error messages from being logged in the System log, use the Component Services snap-in to enable the Local Activation permission to the IIS Wamreg Admin Service for the domain user account that you specified as the Windows SharePoint Services 3.0 service account. To do this, follow these steps:
1. Click Start, click Run, type dcomcnfg in the Open box, and then click OK.
2. Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config.
3. Right-click IIS WAMREG admin Service, and then click Properties.
4. Click the Security tab.
5. Under Launch and Activation Permissions, click Edit.
6. In the Launch Permission dialog box, click Add.
7. In the Select Users, Computers, or Groups dialog box, type the domain user account that you specified as the Windows SharePoint Services 3.0 service account, click Check Names, and then click OK.
8. In the Permissions for UserName list, click to select the Allow check box that is next to Local Activation, and then click OK two times.

Event ID 6398: Still working on Solution (Following steps solved partial problem):

1. Open Start Menu > Administrative Tools > Component Services Tool
2. Drill Down and Expand DCOM Config
3. Navigate to the OSearch, Right Click Properties
4. Select the Security Tab
5. Add the Network Service Account to Local and Activation Permissions
6. Add the Network Service Account to Access Permissions
7. Restart the Office SharePoint Server Search Service from Start Menu > Administrative Tools > Services Tool
-------------------------------

I have found the solution to Error 6398. Please refer to my post here.